GHSA-M687-P538-R5HP Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Summary Vikunja ships with cors.origins defaulting to http://127.0.0.1: and http://localhost:, and sends Access-Control-Allow-Credentials: true, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses. The mandatory...

GHSA-FMMF-XQ98-G327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

GHSA-PJR3-86V4-5P7W Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

Description Summary In Vikunja v2.6.0 the project-permission engine resolves a user's effective permission on a project as the MAX over the entire reachable project subtree. As a result, when a user has been granted a higher permission on a parent project and the owner explicitly shares a child...

GHSA-HJX8-QV73-F7CM Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

Summary A collaborator removed from a project keeps a live, automatic feed of that project's contents, because nothing on any revocation path deletes the webhook they created while they had access. Vikunja already has a revocation-cleanup routine that deletes other derived rows for exactly this...

GHSA-FPRF-R6RV-XG99 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...

GHSA-4HV6-XC92-J86G Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...

GHSA-J3HG-9RP3-5HW9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...

GHSA-9H23-53F4-Q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...

GHSA-PWHX-CVV3-QJ5C Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

GHSA-X34J-47HF-4XG7 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

GHSA-C42Q-QVC3-J6VG @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Summary renders a rich-text AST into the DOM and, for a nodes, assigns the node's URL straight to the anchor's href with no scheme check. A link authored in the CMS as javascript:… renders as a live javascript: anchor, so a visitor who clicks it executes attacker-supplied script in the site's...

GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

GHSA-W2CH-4XGR-22WW Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...

GHSA-8WVG-R2J4-3737 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/taskassignees.go lines 306-344...

GHSA-3HC7-R24J-RPWC Vikunja: Cross-project task disclosure through subtask expansion

Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...

GHSA-G38J-7V97-X298 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

Summary Creating a task relation over CalDAV does not run the TaskRelation.CanCreate permission check that the REST API enforces. An attacker can attach a relation to any task whose UID they know, including tasks in projects they have no access to. The identical operation over REST is correctly...

GHSA-X2RP-9QF7-2FMQ Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.indexprotected, but the authorisation data lives per row in tlsearch. Turning the setting off removes the filter without removing the rows, so protected pages that were indexed...

GHSA-MFXH-VP55-7GC6 Contao: The registration module re-sends activation mails

ModuleRegistration::compile reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORMSUBMIT nor the captcha result computed immediately above it, and resendActivationMail leads to OptInToken::send, which has no rate limit at all. Impact...

GHSA-9FF2-P842-45WQ Contao: Cross-site request forgery in custom backend actions

RequestTokenListener is the only generic REQUESTTOKEN validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an act parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protecti...

GHSA-MRVP-7WMX-5M4H Contao: Path traversal in the images controller

ImagesController joins the user controlled path onto the configured image target directory with Path::join, which canonicalises .. segments, and never calls Path::isBasePath to confirm the result stayed inside that directory. An unauthenticated GET with percent encoded dot segments therefore...

GHSA-628F-V4F6-P37R Contao: Cross-site scripting in the comments bundle

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No Content-Security-Policy header is sent on the Contao back end, so nothing mitigate...

GHSA-Q6WP-FR43-GM9V Contao: Improper access control in the preview links module

core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass$class, false, gets null, silently skips the...

GHSA-5974-GFQC-WRCM Contao: Improper access control in the table access voter

Due to a caching defect in the security voter that governs table-level access to Contao's Data Container DCA backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This include...

GHSA-WQ92-8X3R-FM38 Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API Summary The always-registered Planka migration lets any ordinary user select a Planka server. Although Vikunja caps each JSON response, pagination loop, and attachment independently, it has no...

GHSA-PQF9-H8G4-8GMH Vikunja: Unbounded CSV row cardinality permits API process termination

Unbounded CSV row cardinality permits API process termination Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a string and then materializes a full task object for every row before insertion. Two million one-cell rows f...

GHSA-XXC3-XPMC-VMVR Vikunja: Unbounded nested task-filter recursion permits API process termination

Unbounded nested task-filter recursion permits API process termination Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactical...

GHSA-W7JP-MF2V-8342 Vikunja: Denial of service via decompression bomb in the data import

Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it. Because the archive is...

GHSA-VFXW-3X8P-2VJR Vikunja: Link-share token can enumerate users through the v2 API

Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...

GHSA-39P5-2WRR-XH29 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...

GHSA-4VH2-39RQ-RQ8J Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

GHSA-M469-88XX-8RX2 Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Summary The /dav, /.well-known, and /feeds groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over /dav is unbounded and never returns 429, while /api/v1/login is throttled from the ten...

GHSA-9RG3-V78M-26Q8 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...

GHSA-W39F-H553-H2MX Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Summary The task-position endpoint authorizes only the task side of the write: TaskPosition.CanUpdate delegates to Task.CanUpdate write access to the task's own project and the request body's projectviewid is never validated to belong to the task's project, nor is any access to that view required...

GHSA-QFWC-VX6F-3G6G Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Summary A user who has only read permission on a project can call the single link-share read endpoint and receive the share's hash field — the secret credential that the anonymous POST /shares/share/auth endpoint exchanges for a link-share JWT carrying the share's permission read / read-write /...

GHSA-88F6-4RJV-X774 Vikunja: TOTP secret is readable after enrollment, no step-up auth

Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...

GHSA-6RVJ-QWJF-3M4Q Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Summary registerAPIRoutesV2 never applies the unconditional pre-auth rate-limit floor unauthRateLimit to the v2 public routes — it passes that limiter only to /api/v2/ws — and otherwise relies on setupRateLimit, which registers nothing when ratelimit.enabled is false the default. So on a stock...

GHSA-R6W9-259G-GWRV Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over...

GHSA-XV7Q-FVMC-JX96 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Summary With the per-provider OIDC emailfallback option enabled, Vikunja links an SSO login to a pre-existing local username+password account using only the email claim — no emailverified or Microsoft xmsedov check and no password check, on the unauthenticated callback. An attacker who can make t...

GHSA-P393-CF76-4JMR Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

GHSA-4JFQ-PMQ9-257H ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

GHSA-32R8-5843-4QW2 Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

Summary Vikunja's web.Auth interface pkg/web/web.go, single method GetID int64 is satisfied by BOTH user.User and models.LinkSharing. A link-share's GetID returns the raw positive share.ID pkg/models/linksharing.go:83-85, which lives in the same positive autoincrement ID space as users.id. The sa...

GHSA-6R69-C6WG-7G8M yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

GHSA-3HJ7-6VMJ-H8V4 pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

Impact pacioli-guard's document-layer consent gate requires a human-minted, single-use, document-bound and act-bound marker before a credential carrying API Key Scope.requireconsent may submit or cancel a document. Because ERPNext performs further document writes as a consequence of a governed ac...

GHSA-RJ9J-8772-4H6C Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Summary The task-collection endpoint GET /api/v1/projects/project/views/view/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the view is...

GHSA-VVCV-VPPH-H844 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

GHSA-V3P6-34MC-HJ7V Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

GHSA-68W4-83FH-F2W8 pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Summary Api.getUserData legacy and Api.getuserdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/getuserdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...

GHSA-9Q47-3CM2-2RP8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...

GHSA-JQ7H-WRVP-3RGX pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated. pyLoad authorizes each request from values copied into the Flask session at login. setsession in webui/app/helpers.py writes role and...

GHSA-889W-M37P-88M5 pyLoad: Api.set_user_permission never invalidates the target's session

Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented /api/ RPC surface — e.g. POST /api/setuserpermission or its legacy alias /api/setUserPermission — updates the target's database row but never invalidates that user's existing Flask cookie...