Go Vikunja vulnerabilities, page 4
65 vulnerabilities
Known vulnerabilities in Go Vikunja products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
MediumCVE-2026-33315go-vikunja · vikunja +2 moreVikunja has a 2FA Bypass via Caldav Basic AuthVikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.EPSS0.46%MediumCVE-2026-33474go-vikunja · vikunja +2 moreVikunja Affected by DoS via Image Preview GenerationVikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing during preview generation lets an attacker exhaust CPU and memory with highly compressed but extremely large-dimension images. Version 2.2.0 patches the issue.EPSS0.49%MediumCVE-2026-33473go-vikunja · vikunja +2 moreVikunja has TOTP Reuse During Validity WindowVikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.EPSS0.39%MediumCVE-2026-33675go-vikunja · vikunja +2 moreVikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network ResourcesVikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.EPSS0.40%HighCVE-2026-33316go-vikunja · vikunja +2 moreVikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account DisablementVikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to `StatusActive` after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through `/api/v1/user/password/token` and completing the reset via `/api/v1/user/password/reset`, a disabled user can reactivate their account and bypass administrator-imposed account disablement. Version 2.2.0 patches the issue.EPSS0.46%HighCVE-2026-33680go-vikunja · vikunja +2 moreVikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission EscalationVikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.EPSS0.48%