Description
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | 2.2.0 – < 2.7.0 | 2.7.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | code.vikunja.io/api | >= 2.2.0, <= 2.6.0 | — | GHSA-m687-p538-r5hp |
| Go | code.vikunja.io/api | all versions | — | GO-2026-6739 |
References
- GitHub Security Advisory (GHSA-m687-p538-r5hp) vendor-advisory
- VulnCheck Advisory: Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins third-party-advisory