Technology · Go
code.vikunja.io/api (Go) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 91 vulnerabilities in code.vikunja.io/api (Go): 0 in the last 7 days and 54 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, Vikunja information disclosure in task assignees endpoint, was published on 19 October 2026. 10 vulnerabilities in the last four weeks, down 74% on the four before (38).
- Last 7 days
- 0
- Last 90 days
- 54
- Critical, all time
- 2
- Exploited in the wild
- 0
About code.vikunja.io/api (Go)
Vikunja API is an open-source task and project management application backend written in Go.
Latest code.vikunja.io/api (Go) vulnerabilities
- Vikunja information disclosure in task assignees endpointinfo
- Vikunja task relation deletion missing authorization checkinfo
- Vikunja cross-project task disclosure through subtask expansioninfo
- Vikunja CalDAV relation creation bypasses authorizationinfo
- CVE-2026-111922: Vikunja permissive CORS configuration account takeovermediumCVSS 6.3EPSS 0.1%
- CVE-2026-111921: Vikunja incorrect authorization in link share deletionmediumCVSS 5.4EPSS 0.2%
- CVE-2026-111920: Vikunja broken access control in project permissionsmediumCVSS 4.3EPSS 0.2%
- CVE-2026-111919: Vikunja improper access revocation in webhooksmediumCVSS 6.5EPSS 0.3%
- CVE-2026-111918: Vikunja improper authorization in task position recalculationmediumCVSS 5.4EPSS 0.2%
- CVE-2026-111917: Vikunja WebSocket session validation bypassmediumCVSS 6.5EPSS 0.3%
- CVE-2026-62376: Vikunja plaintext storage of authentication tokens in databasehighCVSS 8.1EPSS 0.2%
- CVE-2026-62367: Vikunja OIDC email-fallback account linking ignores email_verifiedhighCVSS 4EPSS 0.1%
- CVE-2026-57458: Vikunja scoped API token permission bypass in OAuthhighCVSS 8.1EPSS 0.3%
- Vikunja CORS misconfiguration allows token theft from localhost pageshigh
- Vikunja authorization bypass in link share deletionmedium
- Vikunja broken access control in project permission inheritancemediumCVSS 5.4
- Vikunja webhooks and link shares survive access revocationmediumCVSS 6.5
- Vikunja saved filter creation cross-tenant task position writemediumCVSS 5.4
- Vikunja WebSocket authentication bypass ignoring session revocationmediumCVSS 6.5
- Vikunja task relation deletion authorization bypassmediumCVSS 4
- Vikunja task assignees endpoint email disclosure to read-only membersmedium
- Vikunja cross-project task disclosure via subtask expansionmedium
- Vikunja CalDAV relation creation authorization bypassmedium
- CVE-2026-76216: Vikunja link-share principal-type confusion in permission checkshighCVSS 7.5EPSS 0.4%
- Vikunja CalDAV and feeds BasicAuth brute force bypasshighCVSS 7.5
Most severe code.vikunja.io/api (Go) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-56765: Vikunja authorization bypass and IDOR in LinkSharing and TaskAttachmentscriticalCVSS 9.8EPSS 0.5%
- CVE-2026-68582: Vikunja broken object level authorization in task-collection endpointcriticalCVSS 6.5EPSS 0.3%
- CVE-2026-35595: Vikunja privilege escalation via project reparentinghighCVSS 8.3EPSS 0.5%
- CVE-2026-55065: Vikunja authorization bypass in project view deletionhighCVSS 8.1EPSS 0.5%
- CVE-2026-68581: Vikunja API token authentication bypass via link-share ID collisionhighCVSS 8.1EPSS 0.5%
- CVE-2026-57458: Vikunja scoped API token permission bypass in OAuthhighCVSS 8.1EPSS 0.3%
- CVE-2026-62376: Vikunja plaintext storage of authentication tokens in databasehighCVSS 8.1EPSS 0.2%
- Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and managementhighCVSS 8.1
- CVE-2026-91973: Vikunja authentication bypass in CalDAV BasicAuth endpointshighCVSS 7.5EPSS 0.7%
- CVE-2026-91972: Vikunja API v2 missing rate limiting on authentication endpointshighCVSS 7.5EPSS 0.6%
Vulnerabilities per week
10 vulnerabilities in the last four weeks, down 74% on the four before (38). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 5 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 24 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 14 | 0 | |
| 12 Oct 2026 | 6 | 0 | |
| 19 Oct 2026 | 4 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many code.vikunja.io/api (Go) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/code-vikunja-io-api)<a href="https://junglewise.ai/threats/technologies/code-vikunja-io-api"><img src="https://junglewise.ai/threats/technologies/code-vikunja-io-api/badge.svg" alt="code.vikunja.io/api (Go) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/code-vikunja-io-api.json, and this page as text at https://junglewise.ai/threats/technologies/code-vikunja-io-api.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "code.vikunja.io/api (Go) vulnerabilities", https://junglewise.ai/threats/technologies/code-vikunja-io-api, 13 November 2026.