What is CVE-2026-29794?

CVE-2026-29794 is a medium-severity vulnerability in Go-vikunja Vikunja, classified under CWE-807. CVSS score: 5.3/10. Published 2026-03-20.

How severe is CVE-2026-29794?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Go-vikunja Vikunja

CVE-2026-29794

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Rea…

EPSS: 0.001 (31.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Go-vikunja Vikunja — versions >= 0.8, < 2.2.0

Weakness classification (CWE)

CWE-807

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx (x_refsource_CONFIRM)
https://vikunja.io/changelog/vikunja-v2.2.0-was-released (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-29794?: CVE-2026-29794 is a medium-severity vulnerability in Go-vikunja Vikunja, classified under CWE-807. CVSS score: 5.3/10. Published 2026-03-20.
How severe is CVE-2026-29794?: Medium severity. CVSS v3 base score is 5.3 out of 10.