Skip to content
OpenAdvisories

Package · Go

code.vikunja.io/api

67 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

44 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-33313

    Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

    Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API UR…

    go-vikunja vikunja code.vikunja.io/api Go
  • Medium 5.3
    CVE-2026-33312

    Read-only Vikunja users can delete project background images via broken object-level authorization

    Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-o…

    go-vikunja vikunja code.vikunja.io/api Go
  • Medium 5.3
    CVE-2026-29794

    Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

    Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to…

    go-vikunja vikunja code.vikunja.io/api Go
  • Medium 6.1
    CVE-2026-27116

    Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

    Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clic…

    go-vikunja vikunja code.vikunja.io/api Go