Executive brief
Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api
Affected products
- Go code.vikunja.io/api
Junglewise Threat Intelligence
CVE-2026-33676: GO-2026-4847 - Vikunja has Cross-Project Information Disclosure via Task Relations , Missing Authorization Check on Related Task Read in code.vikunja.io/ap
CVE-2026-33676 · Severity: low · CVSS 3.1 · Published 2026-03-26
Technologies: code.vikunja.io/api (Go). Vendors: Go.
Related threats
- Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket
- Vikunja task authorization bypass in bucket endpoint
- Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permit
- Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shar
- Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/pro