CVE-2026-33700

🗓️ 24 Mar 2026 15:51:40Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 2 Views🌐 WEB

CVE-2026-33700: Vikunja pre-2.2.1 allows cross-project link share deletion via IDOR.

Reporter	Title	Published	Views	Family All 25
ATTACKERKB	CVE-2026-33700	24 Mar 202615:51	–	attackerkb
Circl	CVE-2026-33700	24 Mar 202615:16	–	circl
CNNVD	Vikunja 安全漏洞	24 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33700 Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion	24 Mar 202615:51	–	cvelist
EUVD	EUVD-2026-14927	25 Mar 202621:21	–	euvd
Github Security Blog	Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion	25 Mar 202621:21	–	github
NVD	CVE-2026-33700	24 Mar 202616:16	–	nvd
OSV	CVE-2026-33700 Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion	24 Mar 202615:51	–	osv
OSV	GHSA-F95F-77JX-FCJC Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion	25 Mar 202621:21	–	osv
OSV	GO-2026-4850 Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api	26 Mar 202620:33	–	osv

NVD

Vulners

Node

vikunja vikunjaRange<2.2.1

[
  {
    "vendor": "go-vikunja",
    "product": "vikunja",
    "versions": [
      {
        "version": "< 2.2.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/go-vikunja/vikunja/security/advisories/GHSA-f95f-77jx-fcjc
vikunja	www.vikunja.io/changelog/vikunja-v2.2.2-was-released

Parameter	Position	Path	Description	CWE
project	path	/api/v1/projects/:project/shares/:share	DELETE endpoint allows cross-project manipulation of shares due to missing validation of relation between project and share IDs	CWE-639
share	path	/api/v1/projects/:project/shares/:share	DELETE endpoint allows cross-project manipulation of shares due to missing validation of relation between project and share IDs	CWE-639

30 Mar 2026 13:35Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.9

CVSS 46.9

EPSS0.00047

SSVC

CWE-639