Executive brief
Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api
Affected products
- Go code.vikunja.io/api
Junglewise Threat Intelligence
CVE-2026-33700: GO-2026-4850 - Vikunja has a Link Share Delete IDOR , Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api
CVE-2026-33700 · Severity: medium · CVSS 4 · Published 2026-03-26
Technologies: code.vikunja.io/api (Go). Vendors: Go.
Related threats
- Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket
- Vikunja task authorization bypass in bucket endpoint
- Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permit
- Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shar
- Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/pro