Go-Vikunja Vikunja
43 CVEs affecting Go-Vikunja Vikunja. Latest disclosed: 2026-08-28. Critical: 3, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28268 | Critical | 9.8 | 2026-02-27 | Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechan… |
CVE-2026-33334 | Critical | 9.6 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper ena… |
CVE-2026-27575 | Critical | 9.1 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, passwor… |
CVE-2026-33336 | High | 8.8 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper ena… |
CVE-2026-35595 | High | 8.3 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires… |
CVE-2026-55065 | High | 8.1 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated… |
CVE-2026-68581 | High | 8.1 | 2026-08-02 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric… |
CVE-2026-33678 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id =… |
CVE-2026-33668 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locke… |
CVE-2026-33316 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regai… |
CVE-2026-33335 | High | 8.0 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper pas… |
CVE-2026-76216 | High | 7.5 | 2026-08-19 | Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id ==… |
CVE-2026-33680 | High | 7.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated user… |
CVE-2026-34727 | High | 7.4 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the… |
CVE-2026-27616 | High | 7.3 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. S… |
CVE-2026-27819 | High | 7.2 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of th… |
CVE-2026-55066 | High | 7.1 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a b… |
CVE-2026-68582 | Medium | 6.5 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/… |
CVE-2026-35599 | Medium | 6.5 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an O(n) loop that advances a date by… |
CVE-2026-35594 | Medium | 6.5 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_… |