vikunja vulnerabilities and CVEs
Known vulnerabilities affecting vikunja, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
40 vulnerabilities tracked.
- 8.7 Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass…
- 8.4 Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links,…
- 7.6 Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep…
- 7.6 Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to…
- 7.6 Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain…
- 7.1 Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote…
- 7.1 Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory…
- 7.1 Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted…
- 7.1 Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of…
- 7.1 Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading…
- 7.1 Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams…
- 7.1 Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to…
- 7.1 Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory…
- 6.9 Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to…
- 6.9 Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request…
- 6.9 Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask…
- 6.8 Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because…
- 6.0 Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable…
- 6.0 Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to…
- 6.0 Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by…
- 5.3 Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations…
- 5.3 Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only externalid field…
- 5.3 Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's…
- 5.3 Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after…
- 5.3 Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create…
- 5.3 Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create…
- 5.3 Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to…
- 5.3 Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full…
- 5.3 Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete…
- 5.3 Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access…
- 5.1 Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject…
- 5.1 Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients…
- 5.1 Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by…
- 5.1 Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks,…
- 5.1 Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account…
- 5.1 Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that…
- 4.8 Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the…
- 2.1 Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions…
- 2.0 Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by…
- 1.0 Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that vikunja is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Linux Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Chrome Red Hat Enterprise Linux 10 macOS API Connect Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat Enterprise Linux 9.6 Extended Update Support Zephyr Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On iOS and iPadOS Red Hat Hardened Images Windows Server 2022 Windows 11 version 26H1 Windows 11 Version 24H2 Windows Server 2025 Windows 11 Version 25H2