Skip to content
OpenAdvisories

Vendor

go-vikunja

105 known vulnerabilities.

Products

vikunja 105
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-62367 Public exploit

    Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

    Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+…

    go-vikunja vikunja code.vikunja.io/api Go
  • Medium 6.5
    CVE-2026-68582 Public exploit

    Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

    Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path witho…

    go-vikunja vikunja code.vikunja.io/api Go