CVE-2026-33313

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to...

CVE-2026-33313

CVE-2026-33313 / GHSA-MR3J-P26X-72X4 – Vikunja IDOR in Task Comments : An authenticated user who can read a task can read any comment by ID by substituting a task ID in the API URL (GET /api/v1/tasks/{taskID}/comments/{commentID}). Root cause: the system constructs a Task from the URL taskID and ...

PT-2026-26751

Name of the Vulnerable Software and Affected Versions Vikunja affected versions not specified Description An authenticated user can access task comments without proper authorization checks. Specifically, an attacker can read any task comment by ID, even if they do not have access to the associate...