Skip to content
OpenAdvisories

Package · Go

code.vikunja.io/api

67 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-56765

    Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

    Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against …

    Vikunja Vikunja code.vikunja.io/api Go
  • Critical 9.8
    CVE-2026-28268

    Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

    Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to …

    go-vikunja vikunja code.vikunja.io/api Go
  • Critical 9.1
    CVE-2026-27575

    Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

    Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after…

    go-vikunja vikunja code.vikunja.io/api Go