go-vikunja vulnerabilities

Latest high and critical flaws

• CVE-2026-111922 Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publHigh 7.2 · Oct 17, 2026
• CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooHigh 7.1 · Oct 17, 2026
• CVE-2026-111917 Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAHigh 7.1 · Oct 17, 2026
• CVE-2026-62376 Vikunja is an open-source self-hosted task management platform.High 8.1 · Oct 9, 2026
• CVE-2026-62367 Vikunja is an open-source self-hosted task management platform.High 7.5 · Oct 9, 2026
• CVE-2026-57458 Vikunja is an open-source self-hosted task management platform.High 8.1 · Oct 9, 2026
• CVE-2026-91985 Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the shaHigh 8.7 · Sep 15, 2026
• CVE-2026-91979 Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service.High 7.1 · Sep 15, 2026
• CVE-2026-91973 Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection.High 8.7 · Sep 15, 2026
• CVE-2026-91972 Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token High 8.7 · Sep 15, 2026
• CVE-2026-91971 Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted imagesHigh 7.1 · Sep 15, 2026
• CVE-2026-91970 Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migrationHigh 7.1 · Sep 15, 2026
• CVE-2026-91969 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardHigh 7.1 · Sep 15, 2026
• CVE-2026-91968 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recuHigh 7.1 · Sep 15, 2026
• CVE-2026-55066 Vikunja is an open-source self-hosted task management platform.High 7.1 · Aug 28, 2026
• CVE-2026-55065 Vikunja is an open-source self-hosted task management platform.High 8.1 · Aug 28, 2026
• CVE-2026-76216 Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == NHigh 7.7 · Aug 19, 2026
• CVE-2026-68582 Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{Critical 9.3 · Aug 2, 2026
• CVE-2026-68581 Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management.High 8.6 · Aug 2, 2026
• CVE-2026-35595 Vikunja is an open-source self-hosted task management platform.High 8.3 · Apr 10, 2026
• CVE-2026-34727 Vikunja is an open-source self-hosted task management platform.High 7.4 · Apr 10, 2026
• CVE-2026-33680 Vikunja is an open-source self-hosted task management platform.High 7.5 · Mar 24, 2026
• CVE-2026-33678 Vikunja is an open-source self-hosted task management platform.High 8.1 · Mar 24, 2026
• CVE-2026-33668 Vikunja is an open-source self-hosted task management platform.High 7.1 · Mar 24, 2026
• CVE-2026-33316 Vikunja is an open-source self-hosted task management platform.High 8.1 · Mar 24, 2026