Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...

GHSA-VFXW-3X8P-2VJR Vikunja: Link-share token can enumerate users through the v2 API

Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...

EUVD-2026-78652

Vikunja: Link-share token can enumerate users through the v2 API...

Vikunja: Link-share token can enumerate users through the v2 API

Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...

EUVD-2026-78654

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts...

GHSA-9RG3-V78M-26Q8 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...

Vikunja: TOTP secret is readable after enrollment, no step-up auth

Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...

EUVD-2026-78653

Vikunja: TOTP secret is readable after enrollment, no step-up auth...

CVE-2026-57458

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the "oauth.authorize" permission can call "POST /api/v1/oauth/authorize", obtain an OAuth authorization code, and exchange the code at "POST /api/v1/oauth/token" for a normal bearer JSO...

CVE-2026-57458 Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

CVE-2026-57458

The Vikunja task management platform (version 2.3.0 ) contains a vulnerability where a scoped API token restricted to the oauth.authorize permission can be used to mint unrestricted OAuth session credentials. Specifically, an attacker can call POST /api/v1/oauth/authorize to obtain an authorizati...

EUVD-2026-95991

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

GHSA-RJ9J-8772-4H6C Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Summary The task-collection endpoint GET /api/v1/projects/project/views/view/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the view is...

EUVD-2026-51991

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management...

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

GHSA-VVCV-VPPH-H844 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

GHSA-V3P6-34MC-HJ7V Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

CVE-2026-107857 Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtrcloudtoken and @mindwtrwebdavpassword. A party with access to the application...