CVE-2026-115507

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...

EUVD-2026-108339

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...

CVE-2026-115507

Vikunja versions 2.2.0 before 2.7.1 are vulnerable to an HTML injection flaw within the CreateConversationalHeader function in pkg/notifications/mail.go. The vulnerability occurs because the application interpolates display names, task titles, and project titles raw into email anchors. An authent...

GO-2026-6739 Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6733 Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api...

GO-2026-6715 Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-6717 Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6747 Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint v1 and v2 and escalate to the share's permission level in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mappe...

GO-2026-6731 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6752 Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api

Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6722 Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api

Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6745 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission broken access control / privilege-management regression in v2.6.0 in code.vikunja.io/api...

GO-2026-6730 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6726 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-6748 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-6750 Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api

Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-6721 Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...

GO-2026-6749 Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6758 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api

Vikunja: OIDC email-fallback account linking ignores emailverified, enabling local-account takeover in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-6753 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...