CVE-2026-91983

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

EUVD-2026-78654

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-91983

Vikunja before 2.6.0 contains an API token scope bypass in its task read endpoints. The root cause is that authorization logic fails to inspect query string parameters , allowing attackers holding limited-scope tokens to leverage the expand parameter to access restricted data such as comments, re...

CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

PT-2026-92097

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-91983: Incorrect Authorization

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

REST API pagination (eg, /rest/api/space) returns more data than available

h3. Issue Summary This issue relates to general paginated results. Requesting data from an endpoint such as /rest/api/space or rest/api/content causes Confluence to return more data than available. This is reproducible on Data Center: yes h3. Steps to Reproduce Request /rest/api/space to collect...

CVE-2011-2179

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

UBUNTU-CVE-2011-2179

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...