Security
فارسی
All products

code.vikunja.io/api

Go · Package
67 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)CVE-2026-111920 · GHSA-PJR3-86V4-5P7WVersion ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission checkCVE-2026-111921 · GHSA-FMMF-XQ98-G327Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushesCVE-2026-111917 · GHSA-4HV6-XC92-J86GVersion ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosureCVE-2026-76216 · GHSA-32R8-5843-4QW2Version ranges need review. code.vikunja.io/api Go High Fix reported
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenantsCVE-2026-111918 · GHSA-FPRF-R6RV-XG99Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removalGHSA-W2CH-4XGR-22WW · GO-2026-6754Version ranges need review. code.vikunja.io/api Go Low Fix reported
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpointGHSA-8WVG-R2J4-3737 · GO-2026-6723Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Cross-project task disclosure through subtask expansionGHSA-3HC7-R24J-RPWC · GO-2026-6714Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UIDGHSA-G38J-7V97-X298 · GO-2026-6732Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limitedCVE-2026-91972 · GHSA-6RVJ-QWJF-3M4QVersion ranges need review. code.vikunja.io/api Go High Fix reported
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)CVE-2026-91983 · GHSA-9RG3-V78M-26Q8Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplificationCVE-2026-91971 · GHSA-4VH2-39RQ-RQ8JVersion ranges need review. code.vikunja.io/api Go High Fix reported
Vikunja: Unbounded CSV row cardinality permits API process terminationCVE-2026-91969 · GHSA-PQF9-H8G4-8GMHVersion ranges need review. code.vikunja.io/api Go High Fix reported
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)CVE-2026-68582 · GHSA-RJ9J-8772-4H6CVersion ranges need review. code.vikunja.io/api Go Critical Fix reported
Vikunja: TOTP secret is readable after enrollment, no step-up authCVE-2026-91982 · GHSA-88F6-4RJV-X774Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Link-share principal ID collision allows cross-account API token issuance and managementCVE-2026-68581 · GHSA-VVCV-VPPH-H844Version ranges need review. code.vikunja.io/api Go High Fix reported
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway projectCVE-2026-91980 · GHSA-39P5-2WRR-XH29Version ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the APICVE-2026-91970 · GHSA-WQ92-8X3R-FM38Version ranges need review. code.vikunja.io/api Go High Fix reported
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)CVE-2026-91984 · GHSA-W39F-H553-H2MXVersion ranges need review. code.vikunja.io/api Go Medium Fix reported
Vikunja: Unbounded nested task-filter recursion permits API process terminationCVE-2026-91968 · GHSA-XXC3-XPMC-VMVRVersion ranges need review. code.vikunja.io/api Go High Fix reported