CVE-2026-33700: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

Vulnerability summary

CVE-2026-33700 is a medium (CVSS 6.9) vulnerability in go-vikunja vikunja. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.

Timeline

1. 24-03-2026
   PublishedVulnerability first disclosed.
2. 24-03-2026
   Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID. Version 2.2.1 patches the issue.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.