CVE-2026-33676: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

Vulnerability summary

CVE-2026-33676 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in go-vikunja vikunja. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-03-2026
   PublishedVulnerability first disclosed.
2. 24-03-2026
   Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.