cmd

package

Go to main page

Versions in this module

v0

v0.24.6

Dec 22, 2024 GO-2026-4480 +66 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

GO-2026-4951: Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output in code.vikunja.io/api

GO-2026-4952: Vikunja vulnerable to Privilege Escalation via Project Reparenting in code.vikunja.io/api

GO-2026-5111: Vikunja has HTML Injection via Task Titles in Overdue Email Notifications in code.vikunja.io/api

GO-2026-5114: Vikunja Missing Authorization on CalDAV Task Read in code.vikunja.io/api

GO-2026-5258: Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path in code.vikunja.io/api

GO-2026-5276: Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade in code.vikunja.io/api

GO-2026-5362: Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout in code.vikunja.io/api

GO-2026-5428: Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug in code.vikunja.io/api

GO-2026-5582: Vikunja has File Size Limit Bypass via Vikunja Import in code.vikunja.io/api

GO-2026-5608: Vikunja has Algorithmic Complexity DoS in Repeating Task Handler in code.vikunja.io/api

GO-2026-5650: Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds in code.vikunja.io/api

GO-2026-6306: Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 in code.vikunja.io/api

GO-2026-6307: Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment in code.vikunja.io/api

GO-2026-6308: Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id in code.vikunja.io/api

GO-2026-6311: Vikunja has a project duplication bypasses write-permission check on the target parent project in code.vikunja.io/api

GO-2026-6313: Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

GO-2026-6711: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api

GO-2026-6713: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api

GO-2026-6714: Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api

GO-2026-6715: Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api

GO-2026-6717: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api

GO-2026-6721: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api

GO-2026-6722: Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api

GO-2026-6723: Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api

GO-2026-6726: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

GO-2026-6730: Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api

GO-2026-6731: Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api

GO-2026-6732: Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api

GO-2026-6733: Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api

GO-2026-6737: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/api

GO-2026-6739: Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api

GO-2026-6745: Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

GO-2026-6746: Vikunja: Unbounded CSV row cardinality permits API process termination in code.vikunja.io/api

GO-2026-6747: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api

GO-2026-6748: Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api

GO-2026-6749: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api

GO-2026-6750: Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api

GO-2026-6752: Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api

GO-2026-6753: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api

GO-2026-6754: Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api

GO-2026-6755: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) in code.vikunja.io/api

GO-2026-6756: Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api

GO-2026-6757: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API in code.vikunja.io/api

GO-2026-6758: Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api

GO-2026-6759: Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api

v0.24.5

Nov 21, 2024 GO-2026-4480 +65 more