Technology · Vikunja
Vikunja vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 91 vulnerabilities in Vikunja: 29 in the last 7 days and 77 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123531, was published on 8 November 2026. 35 vulnerabilities in the last four weeks, down 5% on the four before (37).
- Last 7 days
- 29
- Last 90 days
- 77
- Critical, all time
- 2
- Exploited in the wild
- 0
About Vikunja
Vikunja is an open-source project management and task management web application.
Latest Vikunja vulnerabilities
- CVE-2026-123531: Vikunja denial of service via pagination bypass in API v1highCVSS 8.8
- CVE-2026-123530: Vikunja missing authentication in TOTP enrollmentmediumCVSS 5.9
- CVE-2026-123529: Vikunja stored CSS injection in rich-text table cellsmediumCVSS 4.6
- CVE-2026-123528: Vikunja insufficient session expiration in HTTP token middlewaremediumCVSS 6.8
- CVE-2026-123527: Vikunja API token authorization bypass in v1/v2 collisionmediumCVSS 5.4
- CVE-2026-123526: Vikunja mass assignment in team external_id fieldmediumCVSS 5.4
- CVE-2026-123525: Vikunja unbounded memory allocation in migration importersmediumCVSS 6.5
- CVE-2026-123524: Vikunja information disclosure via webhook related_tasksmediumCVSS 5.7
- CVE-2026-123523: Vikunja uncontrolled resource consumption in avatar cachemediumCVSS 6.5
- CVE-2026-123522: Vikunja authorization bypass in Kanban task webhookhighCVSS 7.1
- CVE-2026-123521: Vikunja improper restriction of excessive authentication attemptsmediumCVSS 5.9
- CVE-2026-123520: Vikunja privilege escalation via account deletionhighCVSS 7.1
- CVE-2026-123518: Vikunja authorization bypass in kanban task-bucket movemediumCVSS 4.3
- CVE-2026-123516: Vikunja resource exhaustion in ZIP file importermediumCVSS 4.3
- CVE-2026-123515: Vikunja client-side request forgery in rich-text imagesmediumCVSS 4.1
- CVE-2026-123514: Vikunja improper resource cleanup in export archivesmediumCVSS 4.3
- CVE-2026-123513: Vikunja credential exposure via API URL changemediumCVSS 6.8
- CVE-2026-123512: Vikunja authentication tokens in URL query string leaking to access logsmediumCVSS 6.1
- CVE-2026-123511: Vikunja uncontrolled resource consumption in CalDAVmediumCVSS 4.3
- CVE-2026-123509: Vikunja uncontrolled resource consumption in kanban bucketsmediumCVSS 4.3
- CVE-2026-123506: Vikunja authorization bypass in webhook API scopemediumCVSS 5.4
- CVE-2026-123505: Vikunja insecure file permissions in local storagemediumCVSS 5.5
- CVE-2026-123504: Vikunja information disclosure in webhook URLsmediumCVSS 4.3
- CVE-2026-123503: Vikunja authorization bypass in bucket deletionmediumCVSS 5.4
- CVE-2026-123502: Vikunja link-share hash information exposure via request loggingmediumCVSS 5.2
Most severe Vikunja vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-56765: Vikunja authorization bypass and IDOR in LinkSharing and TaskAttachmentscriticalCVSS 9.8EPSS 0.5%
- CVE-2026-68582: Vikunja broken object level authorization in task-collection endpointcriticalCVSS 6.5EPSS 0.3%
- CVE-2026-123531: Vikunja denial of service via pagination bypass in API v1highCVSS 8.8
- CVE-2026-35595: Vikunja privilege escalation via project reparentinghighCVSS 8.3EPSS 0.5%
- CVE-2026-55065: Vikunja authorization bypass in project view deletionhighCVSS 8.1EPSS 0.5%
- CVE-2026-68581: Vikunja API token authentication bypass via link-share ID collisionhighCVSS 8.1EPSS 0.5%
- CVE-2026-57458: Vikunja scoped API token permission bypass in OAuthhighCVSS 8.1EPSS 0.3%
- CVE-2026-62376: Vikunja plaintext storage of authentication tokens in databasehighCVSS 8.1EPSS 0.2%
- CVE-2026-91973: Vikunja authentication bypass in CalDAV BasicAuth endpointshighCVSS 7.5EPSS 0.7%
- CVE-2026-91972: Vikunja API v2 missing rate limiting on authentication endpointshighCVSS 7.5EPSS 0.6%
Vulnerabilities per week
35 vulnerabilities in the last four weeks, down 5% on the four before (37). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 5 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 23 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 14 | 0 | |
| 12 Oct 2026 | 6 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 29 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Vikunja vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/vikunja)<a href="https://junglewise.ai/threats/technologies/vikunja"><img src="https://junglewise.ai/threats/technologies/vikunja/badge.svg" alt="Vikunja vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/vikunja.json, and this page as text at https://junglewise.ai/threats/technologies/vikunja.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Vikunja vulnerabilities", https://junglewise.ai/threats/technologies/vikunja, 9 November 2026.