8534 matches found
CVE-2026-94538 WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CLEANSTART-2026-UV14417 Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI
Security vulnerability affects the airflow-3 package. Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI...
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...
GHSA-8WVG-R2J4-3737 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/taskassignees.go lines 306-344...
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/taskassignees.go lines 306-344...
GHSA-XXC3-XPMC-VMVR Vikunja: Unbounded nested task-filter recursion permits API process termination
Unbounded nested task-filter recursion permits API process termination Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactical...
EUVD-2026-78644
Vikunja: Unbounded nested task-filter recursion permits API process termination...
Vikunja: Unbounded nested task-filter recursion permits API process termination
Unbounded nested task-filter recursion permits API process termination Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactical...
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...
GHSA-9RG3-V78M-26Q8 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...
GHSA-W39F-H553-H2MX Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
Summary The task-position endpoint authorizes only the task side of the write: TaskPosition.CanUpdate delegates to Task.CanUpdate write access to the task's own project and the request body's projectviewid is never validated to belong to the task's project, nor is any access to that view required...
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
Summary The task-position endpoint authorizes only the task side of the write: TaskPosition.CanUpdate delegates to Task.CanUpdate write access to the task's own project and the request body's projectviewid is never validated to belong to the task's project, nor is any access to that view required...
EUVD-2026-78655
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated projectviewid in the task position endpoint v1 and v2...
EUVD-2026-51992
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA...
CVE-2026-106506
A flaw was found in plugin-scaffolder-backend. This vulnerability allows an authenticated user with permission to create and view tasks to access confidential task secrets, resulting in information disclosure. Due to improper input validation in task list ordering, an attacker can submit repeated...
PT-2026-116487
Name of the Vulnerable Software and Affected Versions Vikunja versions 1.0.0-rc0 through 2.6.9 Description An improper authorization issue exists in the RecalculateTaskPositions function. This allows authenticated users who have no accessible projects to write task positions rows for all tasks...
PT-2026-109304
Name of the Vulnerable Software and Affected Versions iStoreOS versions prior to 24.10.7 Description A remote attacker can execute arbitrary code by exploiting the task id variable within the tasks-lib.lua file. Recommendations Update to version 24.10.7 or later. As a temporary mitigation, restri...
CVE-2026-66084
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...
CVE-2026-66082
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...
CVE-2026-66087
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...