Vendor
go-vikunja
105 known vulnerabilities.
Products
74 results · Clear filters · Feed
-
Medium 5.9
Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints
Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock t…
-
Medium 4.6
Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color
Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or …
-
Medium 6.8
Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after l…
-
Medium 5.4
Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delet…
-
Medium 5.4
Vikunja before 2.7.1 Mass Assignment via Team external_id Field
Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, per…
-
Medium 6.5
Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations
Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that referen…
-
Medium 5.7
Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload
Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user…
-
Medium 6.5
Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, c…
-
Medium 5.9
Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint
Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the pa…
-
Medium 6.5
Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousand…
-
Medium 4.3
Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with writ…
-
Medium 4.3
Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint
Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own use…
-
Medium 4.3
Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import
Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty o…
-
Medium 4.1
Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images
Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, proje…
-
Medium 4.3
Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion
Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their a…
-
Medium 6.8
Vikunja before 2.7.1 Auth Token Leak via API URL Change
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer …
-
Medium 6.1
Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs
Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a u…
-
Medium 4.3
Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a…
-
Medium 4.3
Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a tas…
-
Medium 5.4
Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints
Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhook…
-
Medium 5.5
Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and export…
-
Medium 4.3
Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members
Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_…
-
Medium 5.4
Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion
Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the la…
-
Medium 5.2
Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging
Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access l…
-
Medium 6.5
Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compr…
-
Medium 6.2
Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath…
-
Medium 5.9
Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server
Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as…
-
Medium 6.8
Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturi…
-
Medium 4.6
Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's cr…
-
Medium 5.4
Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre…
-
Medium 6.3
Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to…
-
Medium 5.4
Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requ…
-
Medium 4.3
Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on s…
-
Medium 6.5
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their web…
-
Medium 5.4
Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their…
-
Medium 6.5
Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access to…
-
Medium 4.3
Vikunja before 2.6.0 Broken Object-Level Authorization via task-position
Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position en…
-
Medium 4.3
Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments…
-
Medium 4.3
Vikunja before 2.6.0 TOTP Secret Disclosure via API
Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret,…
-
Medium 4.3
Vikunja before 2.6.0 User Enumeration via v2 API
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global sea…