Executive brief
Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api
Affected products
- Go code.vikunja.io/api
Junglewise Threat Intelligence
CVE-2026-33675: GO-2026-4851 - Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api
CVE-2026-33675 · Severity: low · CVSS 3.1 · Published 2026-03-26
Technologies: code.vikunja.io/api (Go). Vendors: Go.
Related threats
- Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket
- Vikunja task authorization bypass in bucket endpoint
- Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permit
- Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shar
- Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/pro