Go Vikunja

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-68582	Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any project share link read kanban bucket records - bucket titles and the full created_by user object (username, name, id) - belonging to other tenants' project views, because the task-collection endpoint loads the view from the attacker-controlled URL path without re-authorizing it. The same missing pre-authorization check yields a project/view-ID existence oracle (404 vs non-404) usable by link shares and ordinary authenticated users. No public exploit identified at time of analysis; fixed in 2.4.0.	CRITICAL	9.3	0.2%	67	PoC
CVE-2026-68581	Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully control any target user's API token management by exploiting a numeric ID collision between the independent link-share and user ID sequences. The `/api/v1/tokens` endpoints resolve the caller identity exclusively via the generic `web.Auth.GetID()` interface without validating whether the authenticated principal is a user or a link-share, meaning a link-share JWT whose integer ID equals a victim's user ID is accepted as that user's credential. No CISA KEV listing and no public exploit code have been identified at time of analysis, but successful exploitation yields the ability to mint new API tokens under a victim's identity with attacker-chosen permission scopes, constituting a functional account takeover at the API level.	HIGH	8.6	0.3%	63	PoC
CVE-2026-34727	Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account has TOTP two-factor authentication enrolled, so when OIDC login is combined with the email-fallback mapping, the second factor is skipped completely. Exposure is limited to instances that enable OIDC login with 'emailfallback: true' and where the matched local user has TOTP enabled; the attacker must additionally be able to authenticate to the configured OIDC provider with an email address matching the victim, so default installs without OIDC email fallback are not affected. The flaw is fixed in 2.3.0 (upstream package go/code.vikunja.io/api <= 2.2.2), a public proof-of-concept is published in the vendor advisory, and the project's priority decision is act_now even though EPSS is low at 0.04% (11th percentile); the advisory notes that chaining this with a separate missing email_verified check can also defeat the password for full account takeover.	CRITICAL	9.1	0.0%	46
CVE-2026-91973	Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered by the application's anti-brute-force controls, letting a remote unauthenticated attacker send an unlimited number of credential-guessing requests. Successful guessing against password-only accounts yields full read access to the victim's tasks, projects, and feeds data. The vendor has released 2.6.0 as the fix; no public exploit code or active exploitation has been confirmed in the supplied intelligence.	HIGH	8.7	0.6%	44	PoC
CVE-2026-91972	Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth token issuance) with no rate limiting, so remote unauthenticated attackers can hammer them with unbounded requests to guess credentials, enumerate accounts, and flood mailboxes with password-reset messages. The exposure is a confidentiality problem — the supplied CVSS 4.0 vector rates high impact to data confidentiality but none to integrity or availability — and a vendor patch exists in 2.6.0. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so this is best treated as a hardening gap that becomes serious the moment an instance is reachable from untrusted networks.	HIGH	8.7	0.5%	44	PoC
CVE-2026-91985	Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.	HIGH	8.7	0.4%	44	PoC
CVE-2026-57458	Privilege escalation in Vikunja 2.3.0 allows a user who holds a narrowly scoped API token (permissions {"oauth":["authorize"]}) to exchange that token for unrestricted session credentials, defeating the API-token permission boundary. The token holder calls POST /api/v1/oauth/authorize to obtain an OAuth authorization code and then POST /api/v1/oauth/token to trade it for a normal bearer JWT and refresh token that are not bound to the original token's scope - runtime validation showed the scoped token could not read GET /api/v1/user, while the minted token could reach both /api/v1/user and /api/v1/projects. The vulnerability requires an already-issued scoped token from the same user (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, CWE-269), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). Version 2.4.0 fixes the issue.	HIGH	8.1	0.3%	41
CVE-2026-62376	Plaintext storage of password-reset, email-confirmation and account-deletion tokens in Vikunja prior to 2.4.0 allows anyone who already holds read access to the backend database to redeem a pending token and take over the associated account, including administrator accounts, without knowing any password. The vulnerability is a CWE-312 cleartext-storage flaw rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), where the high attack complexity reflects two preconditions rather than any weakness in the exploit itself: the attacker must independently obtain database read access (leaked or misconfigured backups, exposed storage, or a secondary SQL-level exposure), and the victim account must have an unexpired token within its 24-hour lifetime. The vendor advisory publishes proof-of-concept code illustrating the attack (a SQL query harvesting tokens plus a password-reset redemption request); no KEV listing was provided in the available intelligence, so there is no confirmation of active exploitation, and the CVSS vector's PR:N confirms the token-redemption step itself requires no Vikunja application credentials or user interaction.	HIGH	8.1	0.2%	41
CVE-2026-33678	Vikunja, an open-source self-hosted task management platform, contains an insecure direct object reference (IDOR) vulnerability that allows any authenticated user to access or delete attachments belonging to other users' tasks. The vulnerability affects all versions prior to 2.2.1, enabling attackers to enumerate and download attachments by combining their own valid task ID with sequential attachment IDs. With a CVSS score of 8.1 (High severity), this represents a significant confidentiality and integrity risk, though no evidence of active exploitation (KEV) or public proof-of-concept has been reported.	HIGH	8.1	0.0%	41
CVE-2026-76216	Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbitrary user accounts by exploiting numeric ID collisions between LinkSharing principals and user records. Three permission-check code paths lack type guards, causing the application to treat a LinkSharing principal whose id equals N as the user with users.id == N. With a crafted link-share token, an attacker can remove victims from teams, enumerate and delete bot user accounts, or read team membership rosters. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.	HIGH	7.7	0.3%	39
CVE-2026-62367	Unauthenticated account takeover in Vikunja 1.0.0 through 2.3.0 lets an attacker who can obtain an OpenID Connect token carrying a victim's email address log in as that victim with a full session and no victim interaction. The flaw only manifests when an administrator has enabled the non-default per-provider emailfallback option, under which Vikunja resolves an unknown (issuer, subject) pair to a pre-existing local username/password account using the email claim alone - it never inspects email_verified (or Microsoft's xms_edov) and never asks for the matched account's password. Practical exposure is narrow but real: it additionally requires an IdP that will assert a victim's unverified email (a self-service or multi-tenant issuer) and a victim local account that has no TOTP, which the 2.3.0 enforceTOTPIfRequired gate protects; there is no public exploit identified at time of analysis, and no KEV/EPSS signal has been provided, so this is a high-priority fix for the specific vulnerable configuration rather than an ongoing mass-exploitation event.	HIGH	7.5	0.1%	38
CVE-2026-33680	Vikunja, an open-source self-hosted task management platform, contains an authorization bypass vulnerability that allows attackers with read-only link share access to escalate privileges to full admin access. The ReadAllWeb handler fails to enforce proper access controls when listing link shares, exposing secret hashes for higher-privilege shares. Versions prior to 2.2.2 are affected, and a patch is available in version 2.2.2.	HIGH	7.5	0.0%	38
CVE-2026-111922	Account takeover in Vikunja 2.2.0 through 2.6.0 stems from a default CORS policy that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set, so a page served from any local port can call the token refresh endpoint and read the returned bearer JWT. The attack is conditional rather than mass-exploitable: the attacker must be able to host malicious content on the victim's own machine, and the victim must have an active authenticated session; it is not directly exploitable from an arbitrary external internet origin. No public exploit identified at time of analysis.	HIGH	7.2	0.1%	36
CVE-2026-91968	Memory exhaustion in the Vikunja task-filter endpoint lets any authenticated user crash the API service by submitting a filter query containing thousands of nested parentheses, which the recursive expression parser consumes without a depth limit. All deployments before version 2.6.0 are affected (EUVD lists 2.5.0 through 2.5.x), and a single low-privileged account is enough to repeatedly take the backend offline. A vendor advisory and a VulnCheck advisory are published, a patched release exists in 2.6.0, and no public exploit code or CISA KEV entry was identified at time of analysis, though the attack is trivial to reproduce by hand with plain HTTP requests.	HIGH	7.1	0.4%	36	PoC
CVE-2026-91970	An authenticated user of Vikunja before 2.6.0 can exhaust the memory of migration worker processes by launching a Planka import job that points at a server they control, which advertises a large number of individually size-compliant attachments. Because the migrator enforces per-file size limits but no aggregate memory budget, the worker is consumed and the instance becomes unavailable to every user on it. The flaw is rated 7.1 (CVSS 4.0, availability-only impact), requires low privileges but no user interaction, and no public exploit code or CISA KEV entry is associated with it at time of analysis; the vendor has released a fix in 2.6.0.	HIGH	7.1	0.4%	36	PoC

CVE-2026-68582

Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any project share link read kanban bucket records - bucket titles and the full created_by user object (username, name, id) - belonging to other tenants' project views, because the task-collection endpoint loads the view from the attacker-controlled URL path without re-authorizing it. The same missing pre-authorization check yields a project/view-ID existence oracle (404 vs non-404) usable by link shares and ordinary authenticated users. No public exploit identified at time of analysis; fixed in 2.4.0.

CRITICAL

9.3

0.2%

67

PoC

CVE-2026-68581

Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully control any target user's API token management by exploiting a numeric ID collision between the independent link-share and user ID sequences. The `/api/v1/tokens` endpoints resolve the caller identity exclusively via the generic `web.Auth.GetID()` interface without validating whether the authenticated principal is a user or a link-share, meaning a link-share JWT whose integer ID equals a victim's user ID is accepted as that user's credential. No CISA KEV listing and no public exploit code have been identified at time of analysis, but successful exploitation yields the ability to mint new API tokens under a victim's identity with attacker-chosen permission scopes, constituting a functional account takeover at the API level.

HIGH

8.6

0.3%

63

PoC

CVE-2026-34727

Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account has TOTP two-factor authentication enrolled, so when OIDC login is combined with the email-fallback mapping, the second factor is skipped completely. Exposure is limited to instances that enable OIDC login with 'emailfallback: true' and where the matched local user has TOTP enabled; the attacker must additionally be able to authenticate to the configured OIDC provider with an email address matching the victim, so default installs without OIDC email fallback are not affected. The flaw is fixed in 2.3.0 (upstream package go/code.vikunja.io/api <= 2.2.2), a public proof-of-concept is published in the vendor advisory, and the project's priority decision is act_now even though EPSS is low at 0.04% (11th percentile); the advisory notes that chaining this with a separate missing email_verified check can also defeat the password for full account takeover.

CRITICAL

9.1

0.0%

46

CVE-2026-91973

Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered by the application's anti-brute-force controls, letting a remote unauthenticated attacker send an unlimited number of credential-guessing requests. Successful guessing against password-only accounts yields full read access to the victim's tasks, projects, and feeds data. The vendor has released 2.6.0 as the fix; no public exploit code or active exploitation has been confirmed in the supplied intelligence.

HIGH

8.7

0.6%

44

PoC

CVE-2026-91972

Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth token issuance) with no rate limiting, so remote unauthenticated attackers can hammer them with unbounded requests to guess credentials, enumerate accounts, and flood mailboxes with password-reset messages. The exposure is a confidentiality problem — the supplied CVSS 4.0 vector rates high impact to data confidentiality but none to integrity or availability — and a vendor patch exists in 2.6.0. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so this is best treated as a hardening gap that becomes serious the moment an instance is reachable from untrusted networks.

HIGH

8.7

0.5%

44

PoC

CVE-2026-91985

Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.

HIGH

8.7

0.4%

44

PoC

CVE-2026-57458

Privilege escalation in Vikunja 2.3.0 allows a user who holds a narrowly scoped API token (permissions {"oauth":["authorize"]}) to exchange that token for unrestricted session credentials, defeating the API-token permission boundary. The token holder calls POST /api/v1/oauth/authorize to obtain an OAuth authorization code and then POST /api/v1/oauth/token to trade it for a normal bearer JWT and refresh token that are not bound to the original token's scope - runtime validation showed the scoped token could not read GET /api/v1/user, while the minted token could reach both /api/v1/user and /api/v1/projects. The vulnerability requires an already-issued scoped token from the same user (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, CWE-269), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). Version 2.4.0 fixes the issue.

HIGH

8.1

0.3%

41

CVE-2026-62376

Plaintext storage of password-reset, email-confirmation and account-deletion tokens in Vikunja prior to 2.4.0 allows anyone who already holds read access to the backend database to redeem a pending token and take over the associated account, including administrator accounts, without knowing any password. The vulnerability is a CWE-312 cleartext-storage flaw rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), where the high attack complexity reflects two preconditions rather than any weakness in the exploit itself: the attacker must independently obtain database read access (leaked or misconfigured backups, exposed storage, or a secondary SQL-level exposure), and the victim account must have an unexpired token within its 24-hour lifetime. The vendor advisory publishes proof-of-concept code illustrating the attack (a SQL query harvesting tokens plus a password-reset redemption request); no KEV listing was provided in the available intelligence, so there is no confirmation of active exploitation, and the CVSS vector's PR:N confirms the token-redemption step itself requires no Vikunja application credentials or user interaction.

HIGH

8.1

0.2%

41

CVE-2026-33678

Vikunja, an open-source self-hosted task management platform, contains an insecure direct object reference (IDOR) vulnerability that allows any authenticated user to access or delete attachments belonging to other users' tasks. The vulnerability affects all versions prior to 2.2.1, enabling attackers to enumerate and download attachments by combining their own valid task ID with sequential attachment IDs. With a CVSS score of 8.1 (High severity), this represents a significant confidentiality and integrity risk, though no evidence of active exploitation (KEV) or public proof-of-concept has been reported.

HIGH

8.1

0.0%

41

CVE-2026-76216

Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbitrary user accounts by exploiting numeric ID collisions between LinkSharing principals and user records. Three permission-check code paths lack type guards, causing the application to treat a LinkSharing principal whose id equals N as the user with users.id == N. With a crafted link-share token, an attacker can remove victims from teams, enumerate and delete bot user accounts, or read team membership rosters. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

HIGH

7.7

0.3%

39

CVE-2026-62367

Unauthenticated account takeover in Vikunja 1.0.0 through 2.3.0 lets an attacker who can obtain an OpenID Connect token carrying a victim's email address log in as that victim with a full session and no victim interaction. The flaw only manifests when an administrator has enabled the non-default per-provider emailfallback option, under which Vikunja resolves an unknown (issuer, subject) pair to a pre-existing local username/password account using the email claim alone - it never inspects email_verified (or Microsoft's xms_edov) and never asks for the matched account's password. Practical exposure is narrow but real: it additionally requires an IdP that will assert a victim's unverified email (a self-service or multi-tenant issuer) and a victim local account that has no TOTP, which the 2.3.0 enforceTOTPIfRequired gate protects; there is no public exploit identified at time of analysis, and no KEV/EPSS signal has been provided, so this is a high-priority fix for the specific vulnerable configuration rather than an ongoing mass-exploitation event.

HIGH

7.5

0.1%

38

CVE-2026-33680

Vikunja, an open-source self-hosted task management platform, contains an authorization bypass vulnerability that allows attackers with read-only link share access to escalate privileges to full admin access. The ReadAllWeb handler fails to enforce proper access controls when listing link shares, exposing secret hashes for higher-privilege shares. Versions prior to 2.2.2 are affected, and a patch is available in version 2.2.2.

HIGH

7.5

0.0%

38

CVE-2026-111922

Account takeover in Vikunja 2.2.0 through 2.6.0 stems from a default CORS policy that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set, so a page served from any local port can call the token refresh endpoint and read the returned bearer JWT. The attack is conditional rather than mass-exploitable: the attacker must be able to host malicious content on the victim's own machine, and the victim must have an active authenticated session; it is not directly exploitable from an arbitrary external internet origin. No public exploit identified at time of analysis.

HIGH

7.2

0.1%

36

CVE-2026-91968

Memory exhaustion in the Vikunja task-filter endpoint lets any authenticated user crash the API service by submitting a filter query containing thousands of nested parentheses, which the recursive expression parser consumes without a depth limit. All deployments before version 2.6.0 are affected (EUVD lists 2.5.0 through 2.5.x), and a single low-privileged account is enough to repeatedly take the backend offline. A vendor advisory and a VulnCheck advisory are published, a patched release exists in 2.6.0, and no public exploit code or CISA KEV entry was identified at time of analysis, though the attack is trivial to reproduce by hand with plain HTTP requests.

HIGH

7.1

0.4%

36

PoC

CVE-2026-91970

An authenticated user of Vikunja before 2.6.0 can exhaust the memory of migration worker processes by launching a Planka import job that points at a server they control, which advertises a large number of individually size-compliant attachments. Because the migrator enforces per-file size limits but no aggregate memory budget, the worker is consumed and the instance becomes unavailable to every user on it. The flaw is rated 7.1 (CVSS 4.0, availability-only impact), requires low privileges but no user interaction, and no public exploit code or CISA KEV entry is associated with it at time of analysis; the vendor has released a fix in 2.6.0.

HIGH

7.1

0.4%

36

PoC

Severity Breakdown

Monthly CVE Trend

Affected Products (4)

Top Risky CVEs