What’s Vulnerable › Products

go-vikunja vikunja vulnerabilities

67 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 67 published in the last 12 months.

Check whether your go-vikunja vikunja version is affected

Latest go-vikunja vikunja vulnerabilities

• CVE-2026-115507 — Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header (CVSS 3.5)
• CVE-2026-111922 — Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins (CVSS 6.3)
• CVE-2026-111921 — Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion (CVSS 5.4)
• CVE-2026-111920 — Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions (CVSS 4.3)
• CVE-2026-111919 — Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks (CVSS 6.5)
• CVE-2026-111918 — Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation (CVSS 5.4)
• CVE-2026-111917 — Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation (CVSS 6.5)
• CVE-2026-62376 — Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access (CVSS 8.1)
• CVE-2026-62367 — Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover (CVSS 7.5)
• CVE-2026-57458 — Vikunja: Scoped API token can mint unrestricted OAuth session credentials (CVSS 8.1)
• CVE-2026-91985 — Vikunja before 2.6.0 Privilege Escalation via Link Share Hash (CVSS 7.5)
• CVE-2026-91984 — Vikunja before 2.6.0 Broken Object-Level Authorization via task-position (CVSS 4.3)
• CVE-2026-91983 — Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter (CVSS 4.3)
• CVE-2026-91982 — Vikunja before 2.6.0 TOTP Secret Disclosure via API (CVSS 4.3)
• CVE-2026-91981 — Vikunja before 2.6.0 User Enumeration via v2 API (CVSS 4.3)
• CVE-2026-91980 — vikunja before 2.6.0 Team Enumeration via Project Share (CVSS 4.3)
• CVE-2026-91979 — Vikunja before 2.6.0 Denial of Service via Decompression Bomb (CVSS 6.5)
• CVE-2026-91973 — Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth (CVSS 7.5)
• CVE-2026-91972 — Vikunja before 2.6.0 Authentication Bypass via Unthrottled API (CVSS 7.5)
• CVE-2026-91971 — Vikunja before 2.6.0 Denial of Service via Avatar Upload (CVSS 6.5)
• CVE-2026-91970 — Vikunja before 2.6.0 Resource Exhaustion via Planka Migration (CVSS 6.5)
• CVE-2026-91969 — vikunja before 2.6.0 Resource Exhaustion via CSV Migration (CVSS 6.5)
• CVE-2026-91968 — vikunja before 2.6.0 Denial of Service via unbounded filter recursion (CVSS 6.5)
• CVE-2026-55067 — Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment (CVSS 5.0)
• CVE-2026-55066 — Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id (CVSS 7.1)