Threat database

Vikunja versions prior to 2.7.1 have a vulnerability allowing attackers with a stolen session to brute-force account passwords via unthrottled re-authentication endpoints. This flaw enables guessing passwords through the /user/settings/totp/disable endpoint without triggering lockout, permitting attackers to disable two-factor authentication (TOTP) without a code and achieve persistent account takeover.

Vikunja versions from 0.18.0 up to but not including 2.7.1 contain a privilege escalation vulnerability. This flaw allows team owners to escalate their privileges to admin or ownership of read-only shared projects by exploiting the ability to delete bot accounts. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a denial of service vulnerability where authenticated users can exhaust API process memory by uploading large WeKan or vikunja-file imports without limits on item count. This can cause out-of-memory (OOM) conditions and crash the instance.

Vikunja versions prior to 2.7.1 have an authorization bypass vulnerability in the TaskBucket.CanUpdate function. The flaw allows authenticated users with write access to two different projects to move tasks between projects improperly. This can cause inconsistencies in task bucket counts and toggle task completion states incorrectly. The issue is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have an information disclosure vulnerability that allows authenticated users to infer the existence and certain attributes of private teams by sending DELETE requests to the team member self-removal endpoint. This flaw enables attackers to distinguish whether a team exists, is SSO-managed, or has a single member based on the response differences.

CVE-2026-123516 is a resource exhaustion vulnerability in go-vikunja's vikunja-file ZIP importer affecting versions before 2.7.1. Authenticated users can upload specially crafted ZIP archives with excessive entries that bypass per-entry limits, causing the system to consume excessive CPU and memory. The flaw arises because the scanArchive function processes each entry twice, amplifying resource consumption. This vulnerability has a high severity score of 7.1 and was fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a client-side request forgery vulnerability that allows users with write access to cause viewers' clients to make unintended requests to loopback or LAN addresses. This is achieved by embedding image elements in rich text fields such as tasks, comments, project descriptions, or imported Markdown. The vulnerability enables attackers to trigger blind GET requests to local services and track when viewers open the affected content.

Vikunja versions prior to 2.7.1 have a vulnerability where full-data export archives are not properly cleaned up after exports or account deletions. Authenticated users can repeatedly trigger exports, causing orphaned data archives to accumulate and exhaust disk storage. Additionally, personal data of deleted users remains on disk indefinitely.

Vikunja versions before 2.7.1 have a credential exposure vulnerability where attackers can steal stored authentication tokens by tricking users into switching the frontend API URL. This occurs because the application does not clear origin-independent localStorage tokens, causing bearer tokens and OAuth refresh tokens to be sent to an attacker-controlled server, potentially enabling account takeover.

Vikunja versions prior to 2.7.1 include sensitive tokens for password reset, email confirmation, and account deletion in URL query strings sent via email. These URLs are logged in HTTP access logs and reverse-proxy logs. An attacker with access to these logs can replay unredeemed tokens to hijack accounts or confirm account deletions. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a vulnerability that allows authenticated CalDAV clients to create an unlimited number of dummy tasks by sending VTODOs with thousands of RELATED-TO properties. This can cause database bloat and overload the event pipeline.

CVE-2026-123510 is a vulnerability in go-vikunja vikunja versions before 2.7.1 where the PluginsDir and LogPath are not properly anchored to the service root path. This allows local attackers with write access to the startup working directory to plant malicious plugins or read sensitive logs, including audit logs. The issue is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a resource consumption vulnerability where project writers or view admins can create unlimited kanban buckets due to missing count limits. This allows attackers to generate heavy database load by creating thousands of buckets, causing each kanban read to execute expensive SELECT and COUNT queries per bucket.

Vikunja versions before 2.7.1 have a supply chain vulnerability in their mage release targets, which fetch the xgo module and Docker image using mutable 'latest' references. This allows attackers who compromise the upstream xgo module, image, or registry to inject malicious code into release binaries that are later signed and distributed.

Vikunja versions from 0.24.0 up to but not including 2.7.1 contain a nil pointer dereference vulnerability. This flaw allows project administrators to cause project views to break by saving a filter-mode bucket configuration with a null filter. The validation function skips nil entries, leading to a panic and HTTP 500 errors for all project members when the view is accessed. The issue is fixed in version 2.7.1.

Vikunja versions from 2.2.0 up to but not including 2.7.1 have an authorization bypass vulnerability. This flaw allows users with tokens scoped only to projects_webhooks to manage user-level webhooks of the owner by specifying user_id in request bodies. Exploitation enables attackers to register webhooks to their own receivers, gaining access to reminders and task payloads from all owner projects, and to read, modify, or delete existing user webhooks. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a vulnerability where insecure default file permissions allow local users on a shared host to read sensitive stored data. This occurs because localStorage.Write creates blobs that are world-readable, exposing attachments, project backgrounds, exports, and the SQLite database containing password hashes.

Vikunja versions from 0.22.0 up to but not including 2.7.1 have an information disclosure vulnerability that allows read-only project members to view full webhook target URLs. This exposure can reveal sensitive tokens or API keys embedded in these URLs, potentially enabling unauthorized posting to receiving channels or reuse of keys until they are rotated. The vulnerability is fixed in version 2.7.1.

CVE-2026-123503 is an authorization bypass vulnerability in Vikunja versions before 2.7.1. It allows users with project write access to delete buckets by exploiting a mismatched view ID, bypassing the intended last-bucket deletion rule. This can cause dangling references to default or done buckets and inconsistent task bucket states.

Vikunja versions prior to 2.7.1 have an information exposure vulnerability where sensitive link-share hashes are logged in raw URI form. This allows attackers with access to logs to obtain share hashes that can be reused to gain project JWTs with various permissions. The issue is fixed in version 2.7.1.