Go-Vikunja Vikunja session mechanism issues

go-vikunja Vikunja versions 0.22.0 to 2.7.0 had a session mechanism vulnerability. This vulnerability stemmed from improper access revocation. In this issue, collaborators who have been revoked can still receive task titles and descriptions through the webhook they created, including content...

go-vikunja Vikunja permission granting and access control issues

The go-vikunja Vikunja 2.6.0 version has vulnerabilities related to permission management and access control. These vulnerabilities stem from improper access control in the getProjectAccessForUser function pkg/models/projectaccess.go. This function parses user project permissions as the maximum...

go-vikunja Vikunja configuration error vulnerability

The go-vikunja version from 2.2.0 to 2.7.0 had a configuration error vulnerability. This vulnerability stemmed from overly permissive CORS configurations. Even after setting service.publicurl, all localhost and 127.0.0.1 ports were trusted, and credentials were allowed to be carried. Attackers...

go-vikunja Vikunja Authorization Issue Vulnerability

The go-vikunja Vikunja versions from 1.0.0-rc0 to 2.7.0 had an authorization issue. This vulnerability stemmed from improper authorization in the RecalculateTaskPositions function, allowing authenticated users with access to the project to write to the taskpositions row for all tasks. An attacker...

Go-Vikunja Vikunja session mechanism issues

In versions of go-vikunja from 2.3.0 to 2.7.0, there was a vulnerability related to the session mechanism. This vulnerability occurred because handleAuth did not recheck the JWT sid claim and the sessions table. As a result, WebSocket access remained valid after the session was revoked. Attackers...

CVE-2026-55066

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:28+00:00| published-proof-of-concept| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5pg6-m483-7vrg...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the import process. An attacker can exhaust server storage and potentially cause service disruption by uploading compressed zip files containing files that exceed the configur...

CVE-2026-35598

creationtimestamp| type| source ---|---|--- 2026-04-09 21:44:59+00:00| published-proof-of-concept| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the RemoveProjectBackground process. An attacker can permanently delete background images by sending a DELETE request to the relevant API endpoint with only read-level permissions. Remediation Upgrade...

CVE-2026-27819: Improper Limitation of a Pathname to a Restricted Directory

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the...