CVE-2026-33313

Vikunja CVE-2026-33313: An IDOR in the API allowed an authenticated user to read any task comment by swapping the task ID in the URL with a task they could access. Root cause: insufficient access checks before 2.2.0. Impact: disclosure of comments from tasks not necessarily accessible to the atta...

CVE-2026-33313

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to...

PT-2026-26751

Name of the Vulnerable Software and Affected Versions Vikunja affected versions not specified Description An authenticated user can access task comments without proper authorization checks. Specifically, an attacker can read any task comment by ID, even if they do not have access to the associate...