Filtered by vendor Vikunja
Subscriptions
Total
98 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123493 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds. | ||||
| CVE-2026-123518 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state. | ||||
| CVE-2026-123520 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-11-08 | 7.1 High |
| Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering ensureProjectAdminUser to promote read-only shares and lock out the real owner. | ||||
| CVE-2026-123524 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-11-08 | 5.7 Medium |
| Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task. | ||||
| CVE-2026-123508 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-11-08 | 3.1 Low |
| Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature. | ||||
| CVE-2026-123531 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 8.8 High |
| Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users. | ||||
| CVE-2026-123530 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.9 Medium |
| Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset. | ||||
| CVE-2026-123529 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.6 Medium |
| Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers. | ||||
| CVE-2026-123528 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.8 Medium |
| Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access. | ||||
| CVE-2026-123527 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets. | ||||
| CVE-2026-123526 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login. | ||||
| CVE-2026-123525 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants. | ||||
| CVE-2026-123523 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed. | ||||
| CVE-2026-123522 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 7.1 High |
| Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications. | ||||
| CVE-2026-123521 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.9 Medium |
| Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover. | ||||
| CVE-2026-123519 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance. | ||||
| CVE-2026-123517 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member. | ||||
| CVE-2026-123516 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice. | ||||
| CVE-2026-123515 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.1 Medium |
| Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content. | ||||
| CVE-2026-123514 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely. | ||||