code.vikunja.io/api vulnerabilities (Go)
67 vulnerabilities.
-
code.vikunja.io/apiGo Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins 7.2 High -
code.vikunja.io/apiGo Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion 5.3 Medium -
code.vikunja.io/apiGo Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions 5.3 Medium -
code.vikunja.io/apiGo Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks 7.1 High -
code.vikunja.io/apiGo Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation 5.3 Medium -
code.vikunja.io/apiGo Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation 7.1 High -
code.vikunja.io/apiGo Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal 2.3 Low -
code.vikunja.io/apiGo Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint 5.3 Medium -
code.vikunja.io/apiGo Vikunja: Cross-project task disclosure through subtask expansion 6.0 Medium -
code.vikunja.io/apiGo Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID 6.3 Medium -
code.vikunja.io/apiGo Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access 8.1 High -
code.vikunja.io/apiGo Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover 7.5 High -
code.vikunja.io/apiGo Vikunja: Scoped API token can mint unrestricted OAuth session credentials 8.1 High -
code.vikunja.io/apiGo Vikunja before 2.6.0 Privilege Escalation via Link Share Hash 8.7 High -
code.vikunja.io/apiGo Vikunja before 2.6.0 Broken Object-Level Authorization via task-position 5.3 Medium -
code.vikunja.io/apiGo Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter 5.3 Medium -
code.vikunja.io/apiGo Vikunja before 2.6.0 TOTP Secret Disclosure via API 5.3 Medium -
code.vikunja.io/apiGo Vikunja before 2.6.0 User Enumeration via v2 API 5.3 Medium -
code.vikunja.io/apiGo vikunja before 2.6.0 Team Enumeration via Project Share 5.3 Medium -
code.vikunja.io/apiGo Vikunja before 2.6.0 Denial of Service via Decompression Bomb 7.1 High -
code.vikunja.io/apiGo Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth 8.7 High -
code.vikunja.io/apiGo Vikunja before 2.6.0 Authentication Bypass via Unthrottled API 8.7 High -
code.vikunja.io/apiGo Vikunja before 2.6.0 Denial of Service via Avatar Upload 7.1 High -
code.vikunja.io/apiGo Vikunja before 2.6.0 Resource Exhaustion via Planka Migration 7.1 High -
code.vikunja.io/apiGo vikunja before 2.6.0 Resource Exhaustion via CSV Migration 7.1 High -
code.vikunja.io/apiGo vikunja before 2.6.0 Denial of Service via unbounded filter recursion 7.1 High -
code.vikunja.io/apiGo Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment 5.0 Medium -
code.vikunja.io/apiGo Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id 7.1 High -
code.vikunja.io/apiGo Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api 8.1 High -
code.vikunja.io/apiGo Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 4.3 Medium -
code.vikunja.io/apiGo Vikunja: Project duplication bypasses write-permission check on the target parent project 5.3 Medium -
code.vikunja.io/apiGo Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing 7.7 High -
code.vikunja.io/apiGo Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token 9.3 Critical -
code.vikunja.io/apiGo Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision 8.6 High -
code.vikunja.io/apiGo Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds 4.3 Medium -
code.vikunja.io/apiGo Vikunja has a File Size Limit Bypass via Vikunja Import 5.4 Medium -
code.vikunja.io/apiGo Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output 4.1 Medium -
code.vikunja.io/apiGo Vikunja has HTML Injection via Task Titles in Overdue Email Notifications 5.4 Medium -
code.vikunja.io/apiGo Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler 6.5 Medium -
code.vikunja.io/apiGo Vikunja has Missing Authorization on CalDAV Task Read 4.3 Medium -
code.vikunja.io/apiGo Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout 5.9 Medium -
code.vikunja.io/apiGo Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug 4.3 Medium -
code.vikunja.io/apiGo Vikunja Affected by Privilege Escalation via Project Reparenting 8.3 High -
code.vikunja.io/apiGo Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade 6.5 Medium -
code.vikunja.io/apiGo Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path 7.4 High -
code.vikunja.io/apiGo Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR 9.3 Critical -
code.vikunja.io/apiGo Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion 6.9 Medium -
code.vikunja.io/apiGo Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation 7.5 High -
code.vikunja.io/apiGo Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections 6.4 Medium -
code.vikunja.io/apiGo Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion 8.1 High - Show olderLoading…