CVE-2026-33313

CVE-2026-33313 / GHSA-MR3J-P26X-72X4 – Vikunja IDOR in Task Comments : An authenticated user who can read a task can read any comment by ID by substituting a task ID in the API URL (GET /api/v1/tasks/{taskID}/comments/{commentID}). Root cause: the system constructs a Task from the URL taskID and ...

CVE-2026-33313 Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to...