code.vikunja.io/api (Go)
Advisories
149
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.7.0 or later clears every advisory below that has a fix.
Upgrade commands
go
go get code.vikunja.io/api@v2.7.0 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-m687-p538-r5hp Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-m687-p538-r5hp Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted |
Medium EPSS 0.15% |
>= 2.2.0, <= 2.6.0 | No fix yet |
| GHSA-fmmf-xq98-g327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check |
Medium EPSS 0.21% |
all versions | No fix yet |
| GHSA-fmmf-xq98-g327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check |
Medium EPSS 0.21% |
>= 0.13.0, < 2.7.0 | 2.7.0 |
| GHSA-pjr3-86v4-5p7w Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) |
Medium EPSS 0.19% |
No fix yet | |
| GHSA-pjr3-86v4-5p7w Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) |
Medium EPSS 0.19% |
>= 2.6.0, < 2.7.0 | 2.7.0 |
| GHSA-pjr3-86v4-5p7w Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) |
Medium EPSS 0.19% |
all versions | No fix yet |
| GHSA-hjx8-qv73-f7cm Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed |
High EPSS 0.36% |
>= 0.22.0 | No fix yet |
| GHSA-hjx8-qv73-f7cm Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed |
High EPSS 0.36% |
>= 0.22.0, <= 2.6.0 | No fix yet |
| GHSA-fprf-r6rv-xg99 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants |
Medium EPSS 0.18% |
all versions | No fix yet |
| GHSA-fprf-r6rv-xg99 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants |
Medium EPSS 0.18% |
>= 1.0.0-rc0, < 2.7.0 | 2.7.0 |
| GHSA-4hv6-xc92-j86g Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes |
High EPSS 0.36% |
all versions | No fix yet |
| GHSA-4hv6-xc92-j86g Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes |
High EPSS 0.36% |
>= 2.3.0, < 2.7.0 | 2.7.0 |
| GHSA-w2ch-4xgr-22ww Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal |
Low | all versions | No fix yet |
| GHSA-w2ch-4xgr-22ww Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal |
Low | >= 0.9, < 2.6.0 | 2.6.0 |
| GHSA-8wvg-r2j4-3737 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint |
Medium | all versions | No fix yet |
| GHSA-8wvg-r2j4-3737 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint |
Medium | < 2.6.0 | 2.6.0 |
| GHSA-3hc7-r24j-rpwc Vikunja: Cross-project task disclosure through subtask expansion |
Medium | < 2.6.0 | 2.6.0 |
| GHSA-3hc7-r24j-rpwc Vikunja: Cross-project task disclosure through subtask expansion |
Medium | all versions | No fix yet |
| GHSA-g38j-7v97-x298 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID |
Medium | all versions | No fix yet |
| GHSA-g38j-7v97-x298 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID |
Medium | < 2.6.0 | 2.6.0 |
| GHSA-r6w9-259g-gwrv Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access |
High EPSS 0.28% |
< 2.4.0 | 2.4.0 |
| GHSA-r6w9-259g-gwrv Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access |
High EPSS 0.28% |
all versions | No fix yet |
| GHSA-xv7q-fvmc-jx96 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover |
High EPSS 0.09% |
all versions | No fix yet |
| GHSA-xv7q-fvmc-jx96 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover |
High EPSS 0.09% |
>= 1.0.0, < 2.4.0 | 2.4.0 |
| GHSA-v3p6-34mc-hj7v Vikunja: Scoped API token can mint unrestricted OAuth session credentials |
High EPSS 0.33% |
all versions | No fix yet |
| GHSA-v3p6-34mc-hj7v Vikunja: Scoped API token can mint unrestricted OAuth session credentials |
High EPSS 0.33% |
>= 2.3.0, < 2.4.0 | 2.4.0 |
| GHSA-2922-qgfj-pr7v Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project Withdrawn |
Medium | <= 2.5.0 | No fix yet |
| GHSA-jmr8-r558-3jhx Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth Withdrawn |
Medium | <= 2.5.0 | No fix yet |
| GHSA-jfw3-2gcf-23r5 Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination Withdrawn |
Medium | No fix yet | |
| GHSA-ccgq-fx7h-2v4c Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) Withdrawn |
Medium | <= 2.5.0 | No fix yet |
| GHSA-c2g7-39fr-cp8q Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API Withdrawn |
Medium | >= 2.5.0 | No fix yet |
| GHSA-37rx-7pj5-p885 Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level Withdrawn |
High | <= 2.5.0 | No fix yet |
| GHSA-p2vv-wrh8-x466 Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords Withdrawn |
High | <= 2.5.0 | No fix yet |
| GHSA-69rj-q3v9-vffp Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification Withdrawn |
Medium | <= 2.5.0 | No fix yet |
| GHSA-55p4-8j34-jv53 Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination Withdrawn |
Medium | No fix yet | |
| GHSA-phph-c358-5mwm Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) Withdrawn |
Medium | >= 1.0.0, <= 2.5.0 | No fix yet |
| GHSA-vcgv-7rvm-m3vp Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API Withdrawn |
Medium | <= 2.5.0 | No fix yet |
| GHSA-qfwc-vx6f-3g6g Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level |
High EPSS 0.43% |
< 2.6.0 | 2.6.0 |
| GHSA-qfwc-vx6f-3g6g Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level |
High EPSS 0.43% |
all versions | No fix yet |
| GHSA-w39f-h553-h2mx Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-w39f-h553-h2mx Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) |
Medium EPSS 0.26% |
< 2.6.0 | 2.6.0 |
| GHSA-9rg3-v78m-26q8 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-9rg3-v78m-26q8 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) |
Medium EPSS 0.30% |
>= 1.0.0, < 2.6.0 | 2.6.0 |
| GHSA-88f6-4rjv-x774 Vikunja: TOTP secret is readable after enrollment, no step-up auth |
Medium EPSS 0.35% |
all versions | No fix yet |
| GHSA-88f6-4rjv-x774 Vikunja: TOTP secret is readable after enrollment, no step-up auth |
Medium EPSS 0.35% |
< 2.6.0 | 2.6.0 |
| GHSA-vfxw-3x8p-2vjr Vikunja: Link-share token can enumerate users through the v2 API |
Medium EPSS 0.31% |
< 2.6.0 | 2.6.0 |
| GHSA-vfxw-3x8p-2vjr Vikunja: Link-share token can enumerate users through the v2 API |
Medium EPSS 0.31% |
all versions | No fix yet |
| GHSA-39p5-2wrr-xh29 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project |
Medium EPSS 0.31% |
< 2.6.0 | 2.6.0 |
| GHSA-39p5-2wrr-xh29 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project |
Medium EPSS 0.31% |
all versions | No fix yet |
| GHSA-w7jp-mf2v-8342 Vikunja: Denial of service via decompression bomb in the data import |
Medium EPSS 0.44% |
all versions | No fix yet |
| GHSA-w7jp-mf2v-8342 Vikunja: Denial of service via decompression bomb in the data import |
Medium EPSS 0.44% |
< 2.6.0 | 2.6.0 |
| GHSA-m469-88xx-8rx2 Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords |
High EPSS 0.67% |
all versions | No fix yet |
| GHSA-m469-88xx-8rx2 Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords |
High EPSS 0.67% |
< 2.6.0 | 2.6.0 |
| GHSA-6rvj-qwjf-3m4q Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited |
High EPSS 0.63% |
all versions | No fix yet |
| GHSA-6rvj-qwjf-3m4q Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited |
High EPSS 0.63% |
< 2.6.0 | 2.6.0 |
| GHSA-4vh2-39rq-rq8j Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification |
Medium EPSS 0.44% |
all versions | No fix yet |
| GHSA-4vh2-39rq-rq8j Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification |
Medium EPSS 0.44% |
< 2.6.0 | 2.6.0 |
| GHSA-wq92-8x3r-fm38 Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API |
Medium EPSS 0.38% |
all versions | No fix yet |
| GHSA-wq92-8x3r-fm38 Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API |
Medium EPSS 0.38% |
>= 2.5.0, < 2.6.0 | 2.6.0 |
| GHSA-pqf9-h8g4-8gmh Vikunja: Unbounded CSV row cardinality permits API process termination |
Medium EPSS 0.38% |
all versions | No fix yet |
| GHSA-pqf9-h8g4-8gmh Vikunja: Unbounded CSV row cardinality permits API process termination |
Medium EPSS 0.38% |
>= 2.5.0, < 2.6.0 | 2.6.0 |
| GHSA-xxc3-xpmc-vmvr Vikunja: Unbounded nested task-filter recursion permits API process termination |
Medium EPSS 0.44% |
all versions | No fix yet |
| GHSA-xxc3-xpmc-vmvr Vikunja: Unbounded nested task-filter recursion permits API process termination |
Medium EPSS 0.44% |
>= 2.5.0, < 2.6.0 | 2.6.0 |
| GHSA-569v-q83c-3j3g Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment |
Medium EPSS 0.34% |
all versions | No fix yet |
| GHSA-569v-q83c-3j3g Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment |
Medium EPSS 0.34% |
< 2.4.0 | 2.4.0 |
| GHSA-5pg6-m483-7vrg Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id |
High EPSS 0.37% |
< 2.4.0 | 2.4.0 |
| GHSA-5pg6-m483-7vrg Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id |
High EPSS 0.37% |
all versions | No fix yet |
| GHSA-gg93-x632-9ccv Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key |
High EPSS 0.50% |
>= 0.24.6 | No fix yet |
| GHSA-gg93-x632-9ccv Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key |
High EPSS 0.50% |
>= 0.24.6, < 2.4.0 | 2.4.0 |
| GHSA-44v6-7fxq-vgf4 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 |
Medium EPSS 0.37% |
>= 2.3.0, < 2.4.0 | 2.4.0 |
| GHSA-44v6-7fxq-vgf4 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 |
Medium EPSS 0.37% |
all versions | No fix yet |
| GHSA-f27p-pw2p-9pr4 Vikunja has a project duplication bypasses write-permission check on the target parent project |
Medium EPSS 0.43% |
>= 0.21.0 | No fix yet |
| GHSA-f27p-pw2p-9pr4 Vikunja has a project duplication bypasses write-permission check on the target parent project |
Medium EPSS 0.43% |
>= 0.21.0, < 2.4.0 | 2.4.0 |
| GHSA-9xwc-vwww-qqmw Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure Withdrawn |
High | <= 2.4.0 | No fix yet |
| GHSA-32r8-5843-4qw2 Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure |
High EPSS 0.36% |
all versions | No fix yet |
| GHSA-32r8-5843-4qw2 Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure |
High EPSS 0.36% |
< 2.5.0 | 2.5.0 |
| GHSA-9jrx-vmh8-c6xw Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management Withdrawn |
High | >= 0.22.0, <= 2.3.0 | No fix yet |
| GHSA-p4r4-8cxw-pjx7 Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) Withdrawn |
Medium | >= 0.24.0, <= 2.3.0 | No fix yet |
| GHSA-rj9j-8772-4h6c Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) |
Medium EPSS 0.33% |
>= 0.24.0, < 2.4.0 | 2.4.0 |
| GHSA-rj9j-8772-4h6c Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) |
Medium EPSS 0.33% |
>= 0.24.0 | No fix yet |
| GHSA-vvcv-vpph-h844 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management |
High EPSS 0.46% |
>= 0.22.0 | No fix yet |
| GHSA-vvcv-vpph-h844 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management |
High EPSS 0.46% |
>= 0.22.0, < 2.4.0 | 2.4.0 |
| GHSA-v479-vf79-mg83 Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds |
Medium EPSS 0.22% |
< 2.3.0 | 2.3.0 |
| GHSA-v479-vf79-mg83 Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds |
Medium EPSS 0.22% |
all versions | No fix yet |
| GHSA-qh78-rvg3-cv54 Vikunja has File Size Limit Bypass via Vikunja Import |
High EPSS 0.34% |
< 2.3.0 | 2.3.0 |
| GHSA-qh78-rvg3-cv54 Vikunja has File Size Limit Bypass via Vikunja Import |
High EPSS 0.34% |
all versions | No fix yet |
| GHSA-2g7h-7rqr-9p4r Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output |
Medium EPSS 0.20% |
< 2.3.0 | 2.3.0 |
| GHSA-2g7h-7rqr-9p4r Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output |
Medium EPSS 0.20% |
all versions | No fix yet |
| GHSA-45q4-x4r9-8fqj Vikunja has HTML Injection via Task Titles in Overdue Email Notifications |
Medium EPSS 0.19% |
all versions | No fix yet |
| GHSA-45q4-x4r9-8fqj Vikunja has HTML Injection via Task Titles in Overdue Email Notifications |
Medium EPSS 0.19% |
< 2.3.0 | 2.3.0 |
| GHSA-r4fg-73rc-hhh7 Vikunja has Algorithmic Complexity DoS in Repeating Task Handler |
Medium EPSS 0.35% |
< 2.3.0 | 2.3.0 |
| GHSA-r4fg-73rc-hhh7 Vikunja has Algorithmic Complexity DoS in Repeating Task Handler |
Medium EPSS 0.35% |
all versions | No fix yet |
| GHSA-48ch-p4gq-x46x Vikunja Missing Authorization on CalDAV Task Read |
Medium EPSS 0.22% |
< 2.3.0 | 2.3.0 |
| GHSA-48ch-p4gq-x46x Vikunja Missing Authorization on CalDAV Task Read |
Medium EPSS 0.22% |
all versions | No fix yet |
| GHSA-fgfv-pv97-6cmj Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout |
High EPSS 0.30% |
< 2.3.0 | 2.3.0 |
| GHSA-fgfv-pv97-6cmj Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout |
High EPSS 0.30% |
all versions | No fix yet |
| GHSA-hj5c-mhh2-g7jq Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug |
Medium EPSS 0.27% |
all versions | No fix yet |
| GHSA-hj5c-mhh2-g7jq Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug |
Medium EPSS 0.27% |
< 2.3.0 | 2.3.0 |
| GHSA-2vq4-854f-5c72 Vikunja vulnerable to Privilege Escalation via Project Reparenting |
High EPSS 0.29% |
all versions | No fix yet |
| GHSA-2vq4-854f-5c72 Vikunja vulnerable to Privilege Escalation via Project Reparenting |
High EPSS 0.29% |
< 2.3.0 | 2.3.0 |
| GHSA-96q5-xm3p-7m84 Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade |
Medium EPSS 0.30% |
< 2.3.0 | 2.3.0 |
| GHSA-96q5-xm3p-7m84 Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-8jvc-mcx6-r4cg Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path |
Critical EPSS 0.28% |
< 2.3.0 | 2.3.0 |
| GHSA-8jvc-mcx6-r4cg Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path |
Critical EPSS 0.28% |
all versions | No fix yet |
| GHSA-2pv8-4c52-mf8j Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR |
Critical EPSS 0.51% |
< 2.2.1 | 2.2.1 |
| GHSA-2pv8-4c52-mf8j Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR |
Critical EPSS 0.51% |
all versions | No fix yet |
| GHSA-f95f-77jx-fcjc Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-f95f-77jx-fcjc Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion |
Medium EPSS 0.26% |
< 2.2.1 | 2.2.1 |
| GHSA-8hp8-9fhr-pfm9 Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation |
Medium EPSS 0.40% |
< 2.2.2 | 2.2.2 |
| GHSA-8hp8-9fhr-pfm9 Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation |
Medium EPSS 0.40% |
all versions | No fix yet |
| GHSA-g9xj-752q-xh63 Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download |
High EPSS 0.40% |
< 2.2.1 | 2.2.1 |
| GHSA-g9xj-752q-xh63 Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download |
High EPSS 0.40% |
all versions | No fix yet |
| GHSA-jfmm-mjcp-8wq2 Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion |
High EPSS 0.32% |
< 2.2.1 | 2.2.1 |
| GHSA-jfmm-mjcp-8wq2 Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion |
High EPSS 0.32% |
all versions | No fix yet |
| GHSA-7c2g-p23p-4jg3 Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API |
Medium EPSS 0.30% |
all versions | No fix yet |
| GHSA-7c2g-p23p-4jg3 Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API |
Medium EPSS 0.30% |
< 2.2.1 | 2.2.1 |
| GHSA-8cmm-j6c4-rr8v Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read |
Medium EPSS 0.36% |
all versions | No fix yet |
| GHSA-8cmm-j6c4-rr8v Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read |
Medium EPSS 0.36% |
< 2.2.1 | 2.2.1 |
| GHSA-g66v-54v9-52pr Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources |
Medium EPSS 0.28% |
all versions | No fix yet |
| GHSA-g66v-54v9-52pr Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources |
Medium EPSS 0.28% |
< 2.2.1 | 2.2.1 |
| GHSA-94xm-jj8x-3cr4 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect |
High EPSS 0.46% |
>= 0.18.0 | No fix yet |
| GHSA-94xm-jj8x-3cr4 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect |
High EPSS 0.46% |
>= 0.18.0, < 2.2.1 | 2.2.1 |
| GHSA-wc83-79hj-hpmq Vikunja Affected by DoS via Image Preview Generation |
Medium EPSS 0.32% |
>= 1.0.0-rc0, < 2.2.0 | 2.2.0 |
| GHSA-wc83-79hj-hpmq Vikunja Affected by DoS via Image Preview Generation |
Medium EPSS 0.32% |
all versions | No fix yet |
| GHSA-p747-qc5p-773r Vikunja has TOTP Reuse During Validity Window |
Medium EPSS 0.33% |
>= 0.13 | No fix yet |
| GHSA-p747-qc5p-773r Vikunja has TOTP Reuse During Validity Window |
Medium EPSS 0.33% |
all versions | No fix yet |
| GHSA-vq4q-79hh-q767 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement |
High EPSS 0.38% |
all versions | No fix yet |
| GHSA-vq4q-79hh-q767 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement |
High EPSS 0.38% |
<= 2.1.0 | No fix yet |
| GHSA-47cr-f226-r4pq Vikunja has a 2FA Bypass via Caldav Basic Auth |
Medium EPSS 0.31% |
all versions | No fix yet |
| GHSA-47cr-f226-r4pq Vikunja has a 2FA Bypass via Caldav Basic Auth |
Medium EPSS 0.31% |
<= 2.1.0 | No fix yet |
| GHSA-mr3j-p26x-72x4 Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments |
Medium EPSS 0.27% |
all versions | No fix yet |
| GHSA-mr3j-p26x-72x4 Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments |
Medium EPSS 0.27% |
<= 2.1.0 | No fix yet |
| GHSA-564f-wx8x-878h Vikunja read-only users can delete project background images via broken object-level authorization |
Medium EPSS 0.22% |
>= 0.20.2 | No fix yet |
| GHSA-564f-wx8x-878h Vikunja read-only users can delete project background images via broken object-level authorization |
Medium EPSS 0.22% |
>= 0.20.2, < 2.2.0 | 2.2.0 |
| GHSA-m547-hp4w-j6jx Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers |
Medium EPSS 0.34% |
>= 0.8, < 2.2.0 | 2.2.0 |
| GHSA-m547-hp4w-j6jx Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers |
Medium EPSS 0.34% |
all versions | No fix yet |
| GHSA-rfjg-6m84-crj2 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse |
Critical EPSS 0.75% |
<= 0.24.6 | No fix yet |
| GHSA-rfjg-6m84-crj2 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse |
Critical EPSS 0.75% |
all versions | No fix yet |
| GHSA-42wg-38gx-85rh Vikunja has Path Traversal in CLI Restore |
High EPSS 0.83% |
all versions | No fix yet |
| GHSA-42wg-38gx-85rh Vikunja has Path Traversal in CLI Restore |
High EPSS 0.83% |
<= 0.24.6 | No fix yet |
| GHSA-7jp5-298q-jg98 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure |
High EPSS 0.51% |
all versions | No fix yet |
| GHSA-7jp5-298q-jg98 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure |
High EPSS 0.51% |
<= 0.24.6 | No fix yet |
| GHSA-3ccg-x393-96v8 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change |
Critical EPSS 0.47% |
all versions | No fix yet |
| GHSA-3ccg-x393-96v8 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change |
Critical EPSS 0.47% |
<= 0.24.6 | No fix yet |
| GHSA-4qgr-4h56-8895 Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module |
Medium EPSS 0.26% |
<= 0.24.6 | No fix yet |
| GHSA-4qgr-4h56-8895 Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-m4g2-2q66-vc9v Vikunja Vulnerable to XSS Via Task Preview |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-m4g2-2q66-vc9v Vikunja Vulnerable to XSS Via Task Preview |
Medium EPSS 0.26% |
<= 0.24.6 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor