Threats affecting pkg:golang/vikunja

Vikunja versions from 1.0.0 up to but not including 2.7.1 have a vulnerability that allows authenticated users to bypass the service.maxitemsperpage limit by sending page=0 to certain API list endpoints. This triggers unbounded SQL queries and excessive memory use, which can degrade service availability. The issue is fixed in version 2.7.1.

Vikunja versions prior to 2.7.1 have a missing authentication vulnerability that allows an attacker with a stolen session to enroll and enable TOTP (Time-based One-Time Password) without needing the account password. This enables the attacker to set their own TOTP secret, effectively locking the legitimate user out of their account, and this lockout persists even after a password reset.

Vikunja versions prior to 2.7.1 contain a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. This can enable attackers to create phishing overlays or force background-image requests that deanonymize viewers. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have an insufficient session expiration vulnerability. This flaw allows attackers holding revoked access tokens to continue authenticating because the SetupTokenMiddleware bypasses session and account status checks. As a result, attackers with stolen tokens can mint new OAuth sessions or API tokens even after logout, password reset, or account disabling, enabling persistent unauthorized access.

Vikunja versions from 2.4.0 up to but not including 2.7.1 have an authorization bypass vulnerability due to colliding v1 and v2 API token permission keys. This flaw allows attackers holding tokens with limited permissions to perform unauthorized actions such as deleting project backgrounds or updating buckets. The issue is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a mass assignment vulnerability that allows authenticated users to modify the read-only external_id field via team create and update endpoints. This flaw enables attackers to mark a team as externally managed, which prevents removal of members and causes SSO members to be dropped upon their next login. The issue is fixed in version 2.7.1.

CVE-2026-123525 affects Vikunja versions before 2.7.1 and involves unbounded memory allocation in its Trello, Todoist, and Microsoft To Do migration importers. Authenticated users can trigger migrations that cause excessive memory use by referencing large attachments or oversized API responses, leading to memory exhaustion and crashing the shared API process for all tenants.

Vikunja versions from 0.23.0 up to but not including 2.7.1 have an authorization flaw that allows project collaborators with write access to access task details from projects they should not have access to. This occurs via webhook registration, where webhook payloads are generated with the triggering user's permissions, exposing titles, descriptions, and metadata of tasks in private projects when linked tasks are modified. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. This uncontrolled resource consumption can cause the API process to be terminated due to out-of-memory conditions. The issue is fixed in version 2.7.1.

Vikunja versions prior to 2.7.1 have an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object during a no-op Kanban bucket move. This flaw enables attackers to access full task contents of other users by manipulating task identifiers and project associations, potentially exposing sensitive information.

Vikunja versions prior to 2.7.1 have a vulnerability allowing attackers with a stolen session to brute-force account passwords via unthrottled re-authentication endpoints. This flaw enables guessing passwords through the /user/settings/totp/disable endpoint without triggering lockout, permitting attackers to disable two-factor authentication (TOTP) without a code and achieve persistent account takeover.

Vikunja versions from 0.18.0 up to but not including 2.7.1 contain a privilege escalation vulnerability. This flaw allows team owners to escalate their privileges to admin or ownership of read-only shared projects by exploiting the ability to delete bot accounts. The vulnerability is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a denial of service vulnerability where authenticated users can exhaust API process memory by uploading large WeKan or vikunja-file imports without limits on item count. This can cause out-of-memory (OOM) conditions and crash the instance.

Vikunja versions prior to 2.7.1 have an authorization bypass vulnerability in the TaskBucket.CanUpdate function. The flaw allows authenticated users with write access to two different projects to move tasks between projects improperly. This can cause inconsistencies in task bucket counts and toggle task completion states incorrectly. The issue is fixed in version 2.7.1.

Vikunja versions before 2.7.1 have an information disclosure vulnerability that allows authenticated users to infer the existence and certain attributes of private teams by sending DELETE requests to the team member self-removal endpoint. This flaw enables attackers to distinguish whether a team exists, is SSO-managed, or has a single member based on the response differences.

CVE-2026-123516 is a resource exhaustion vulnerability in go-vikunja's vikunja-file ZIP importer affecting versions before 2.7.1. Authenticated users can upload specially crafted ZIP archives with excessive entries that bypass per-entry limits, causing the system to consume excessive CPU and memory. The flaw arises because the scanArchive function processes each entry twice, amplifying resource consumption. This vulnerability has a high severity score of 7.1 and was fixed in version 2.7.1.

Vikunja versions before 2.7.1 have a client-side request forgery vulnerability that allows users with write access to cause viewers' clients to make unintended requests to loopback or LAN addresses. This is achieved by embedding image elements in rich text fields such as tasks, comments, project descriptions, or imported Markdown. The vulnerability enables attackers to trigger blind GET requests to local services and track when viewers open the affected content.

Vikunja versions prior to 2.7.1 have a vulnerability where full-data export archives are not properly cleaned up after exports or account deletions. Authenticated users can repeatedly trigger exports, causing orphaned data archives to accumulate and exhaust disk storage. Additionally, personal data of deleted users remains on disk indefinitely.

Vikunja versions before 2.7.1 have a credential exposure vulnerability where attackers can steal stored authentication tokens by tricking users into switching the frontend API URL. This occurs because the application does not clear origin-independent localStorage tokens, causing bearer tokens and OAuth refresh tokens to be sent to an attacker-controlled server, potentially enabling account takeover.

Vikunja versions prior to 2.7.1 include sensitive tokens for password reset, email confirmation, and account deletion in URL query strings sent via email. These URLs are logged in HTTP access logs and reverse-proxy logs. An attacker with access to these logs can replay unredeemed tokens to hijack accounts or confirm account deletions. The vulnerability is fixed in version 2.7.1.