EUVD-2026-14923Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the DownloadImage function in pkg/utils/avatar.go uses a bare http.Client{} with no SSRF protection when downloading user avatar images from the OpenID Connect picture claim URL. An attacker who controls their OIDC profile picture URL can force the Vikunja server to make HTTP GET requests to arbitrary internal or cloud metadata endpoints. This bypasses the SSRF protections that are correctly applied to the webhook system. Version 2.2.1 patches the issue.
AnalysisAI
Vikunja versions prior to 2.2.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the avatar image download functionality that fails to implement proper protections when fetching user profile pictures from OpenID Connect provider URLs. An authenticated attacker can exploit this by controlling their OIDC profile picture URL to force the Vikunja server to make arbitrary HTTP GET requests to internal networks or cloud metadata endpoints, potentially disclosing sensitive information. The vulnerability has a CVSS score of 6.4 (medium severity) and is patched in version 2.2.1.
Technical ContextAI
The vulnerability exists in the DownloadImage function within pkg/utils/avatar.go of the Vikunja task management platform (identified by CPE cpe:2.3:a:go-vikunja:vikunja). The root cause is classified under CWE-918 (Server-Side Request Forgery), which occurs when an application fetches remote resources based on user-controlled input without proper validation. Specifically, when processing the picture claim from OpenID Connect provider responses, the code instantiates a bare http.Client{} without implementing SSRF protections such as URL scheme validation, private IP range blocking, or DNS resolution filtering. This contrasts sharply with the webhook system in the same codebase, which correctly implements such protections, indicating this is a consistency/oversight issue rather than a systemic design flaw. The attacker-controlled URL can target internal services (e.g., internal APIs on RFC1918 addresses) or cloud provider metadata endpoints (e.g., AWS EC2 metadata service at 169.254.169.254), creating information disclosure risk.
RemediationAI
Upgrade Vikunja to version 2.2.1 or later, which includes the patched DownloadImage function with proper SSRF protections. The official vendor security advisory is available at https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g9xj-752q-xh63 and the fix can be reviewed at https://github.com/go-vikunja/vikunja/commit/363aa6642352b08fc8bc6aaff2f3a550393af1cf. For deployments where immediate patching is not feasible, implement network segmentation to restrict the Vikunja server's outbound HTTP/HTTPS access to only trusted OIDC provider domains and their CDNs, and disable or restrict OIDC authentication if it is not essential. Additionally, configure firewall rules to prevent access from the Vikunja server to internal metadata endpoints (169.254.169.254 for AWS) and RFC1918 address ranges.
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Vikunja, an open-source self-hosted task management platform, contains an insecure direct object reference (IDOR) vulner
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today