Executive brief
Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api
Affected products
- Go code.vikunja.io/api
Junglewise Threat Intelligence
CVE-2026-33678: GO-2026-4853 - Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api
CVE-2026-33678 · Severity: low · CVSS 3.1 · Published 2026-03-26
Technologies: code.vikunja.io/api (Go). Vendors: Go.
Related threats
- Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket
- Vikunja task authorization bypass in bucket endpoint
- Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permit
- Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shar
- Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/pro