Threats affecting pkg:golang/vikunja

Vikunja versions before 2.7.1 have a vulnerability that allows authenticated CalDAV clients to create an unlimited number of dummy tasks by sending VTODOs with thousands of RELATED-TO properties. This can cause database bloat and overload the event pipeline.

CVE-2026-123510 is a vulnerability in go-vikunja vikunja versions before 2.7.1 where the PluginsDir and LogPath are not properly anchored to the service root path. This allows local attackers with write access to the startup working directory to plant malicious plugins or read sensitive logs, including audit logs. The issue is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a resource consumption vulnerability where project writers or view admins can create unlimited kanban buckets due to missing count limits. This allows attackers to generate heavy database load by creating thousands of buckets, causing each kanban read to execute expensive SELECT and COUNT queries per bucket.

Vikunja versions before 2.7.1 have a supply chain vulnerability in their mage release targets, which fetch the xgo module and Docker image using mutable 'latest' references. This allows attackers who compromise the upstream xgo module, image, or registry to inject malicious code into release binaries that are later signed and distributed.

Vikunja versions from 0.24.0 up to but not including 2.7.1 contain a nil pointer dereference vulnerability. This flaw allows project administrators to cause project views to break by saving a filter-mode bucket configuration with a null filter. The validation function skips nil entries, leading to a panic and HTTP 500 errors for all project members when the view is accessed. The issue is fixed in version 2.7.1.

Vikunja versions from 2.2.0 up to but not including 2.7.1 have an authorization bypass vulnerability. This flaw allows users with tokens scoped only to projects_webhooks to manage user-level webhooks of the owner by specifying user_id in request bodies. Exploitation enables attackers to register webhooks to their own receivers, gaining access to reminders and task payloads from all owner projects, and to read, modify, or delete existing user webhooks. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a vulnerability where insecure default file permissions allow local users on a shared host to read sensitive stored data. This occurs because localStorage.Write creates blobs that are world-readable, exposing attachments, project backgrounds, exports, and the SQLite database containing password hashes.

Vikunja versions from 0.22.0 up to but not including 2.7.1 have an information disclosure vulnerability that allows read-only project members to view full webhook target URLs. This exposure can reveal sensitive tokens or API keys embedded in these URLs, potentially enabling unauthorized posting to receiving channels or reuse of keys until they are rotated. The vulnerability is fixed in version 2.7.1.

CVE-2026-123503 is an authorization bypass vulnerability in Vikunja versions before 2.7.1. It allows users with project write access to delete buckets by exploiting a mismatched view ID, bypassing the intended last-bucket deletion rule. This can cause dangling references to default or done buckets and inconsistent task bucket states.

Vikunja versions prior to 2.7.1 have an information exposure vulnerability where sensitive link-share hashes are logged in raw URI form. This allows attackers with access to logs to obtain share hashes that can be reused to gain project JWTs with various permissions. The issue is fixed in version 2.7.1.

Vikunja versions prior to 2.7.1 contain a vulnerability that allows authenticated users to exhaust server memory by uploading multiple concurrent images. The flaw arises from uncontrolled resource consumption during the decoding of highly compressible PNG images, which can reach up to 50 megapixels each. This can cause the API process to experience memory pressure or be terminated by the operating system due to out-of-memory conditions.

Vikunja versions before 2.7.1 have a vulnerability where dump archives created by the vikunja dump command have insecure default file permissions. This allows local users on a shared host to read these world-readable zip files, potentially exposing sensitive data such as configuration files, password hashes, TOTP secrets, tokens, and stored files.

Vikunja versions before 2.7.1 have a credential exposure vulnerability where malicious repository authors can specify an attacker-controlled server in the .veans.yml file. When veans runs in an untrusted checkout, it may send sensitive credentials such as VEANS_TOKEN, login passwords, TOTP codes, and tokens to the attacker-controlled server, potentially granting unauthorized access to the victim's Vikunja account.

Vikunja versions before 2.7.1 have a prompt injection vulnerability that allows project members with write access to inject instructions via project titles or task content. These inputs are rendered verbatim inside the coding agent's instruction block, enabling attackers to influence the agent's behavior on session start and pre-compact events. This can cause unauthorized modifications to developer checkouts or execution of commands.

Vikunja versions before 2.7.1 have a protocol downgrade vulnerability in the serverCandidates component. This flaw allows on-path attackers to force the use of plain HTTP instead of HTTPS during initialization and login. By blocking HTTPS ports, attackers can cause the client to accept unverified HTTP responses, enabling interception of sensitive data such as passwords, TOTP codes, and bot tokens. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 contain a symlink following vulnerability that allows attackers to write files outside the intended repository by using crafted symbolic links. This can lead to overwriting user files such as ~/.bashrc or installing hooks and plugins globally. The vulnerability is fixed in version 2.7.1.

Vikunja versions 2.0.0 up to but not including 2.7.1 are vulnerable to a Cross-Site Request Forgery (CSRF) attack on the /api/v2 login and OIDC callback endpoints. These endpoints accept form-encoded bodies without verifying CSRF tokens or Origin headers, allowing an attacker with an account to trick a victim into switching to the attacker's account. This can expose data the victim subsequently adds. The vulnerability is fixed in version 2.7.1.

Vikunja versions prior to 2.7.1 have a cross-site request forgery (CSRF) vulnerability in their OAuth migration callbacks for Todoist, Microsoft To Do, and Trello. This flaw allows attackers to import data into a victim's account by exploiting missing state parameter binding in the OAuth flow. Attackers can authorize their own accounts and trick logged-in victims into triggering the migration callback, causing attacker-chosen projects and tasks with phishing links to be imported automatically.

Vikunja versions from 2.4.0 up to but not including 2.7.1 have an authentication bypass vulnerability. This flaw allows disabled or locked users to maintain access via API tokens associated with their bot users. The vulnerability arises because token validation only verifies the bot user's status, not the parent user's status. Attackers with pre-existing bot tokens can continue to read and modify shared projects through multiple interfaces including the HTTP API, CalDAV, MCP, and feeds.

Vikunja versions 2.2.0 through 2.7.0 contain an HTML injection vulnerability in the CreateConversationalHeader function that improperly neutralizes input when generating email notification content. Authenticated users can inject malicious HTML by crafting display names or task/project titles that close email anchor tags, enabling phishing link injection in task-comment and task-mention notification emails sent to project members. This vulnerability was fixed in version 2.7.1.