Threats affecting pkg:golang/vikunja

Vikunja versions from 2.2.0 up to but not including 2.7.0 have a permissive Cross-Origin Resource Sharing (CORS) policy that trusts all localhost and 127.0.0.1 ports with credentials. This misconfiguration allows an attacker controlling a page on any localhost port to send credentialed requests to the token refresh endpoint and obtain the bearer JWT token, potentially taking over the logged-in user's account.

Vikunja versions from 0.13.0 up to but not including 2.7.0 have an incorrect authorization vulnerability. This flaw allows project members with Write permission to delete admin-level link shares by exploiting a permission check that reads an unloaded share object. Attackers can send DELETE requests to project share endpoints with sequential share IDs to revoke admin links and invalidate share sessions.

Vikunja versions from 0.22.0 up to but not including 2.7.0 have a vulnerability where removed collaborators can continue to receive project data via webhooks they created before their access was revoked. This improper access revocation allows former collaborators to receive task titles and descriptions, including new content created after their removal.

Vikunja versions from 1.0.0-rc0 up to but not including 2.7.0 have an improper authorization vulnerability in the RecalculateTaskPositions function. Authenticated users without access to any projects can write task_positions rows across all tasks instance-wide. This flaw allows attackers to manipulate their Inbox and create saved filters that persist cross-tenant references, potentially amplifying writes and causing denial of service.

Vikunja versions 2.3.0 up to but not including 2.7.0 have a session validation vulnerability where WebSocket access can persist after session revocation. This occurs because the handleAuth function does not verify the JWT sid claim against the sessions table. As a result, attackers with a stolen access token can maintain WebSocket connections and continue receiving notifications even after the session is deleted or TOTP enrollment occurs.