Archive
8 November 2026
Vulnerabilities first published on this day (UTC), newest first.
173 results · Clear filters · Feed
-
Medium 4.3
Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a…
-
Medium 4.3
Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a tas…
-
Medium 5.4
Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints
Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhook…
-
Medium 5.5
Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and export…
-
Medium 4.3
Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members
Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_…
-
Medium 5.4
Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion
Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the la…
-
Medium 5.2
Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging
Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access l…
-
Medium 6.5
Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compr…
-
Medium 6.2
Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath…
-
Medium 5.9
Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server
Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as…
-
Medium 6.8
Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturi…
-
Medium 4.6
Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's cr…
-
Medium 5.4
Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre…