# Vikunja vulnerabilities Source: https://junglewise.ai/threats/technologies/vikunja Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/vikunja.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 91 vulnerabilities in Vikunja: 29 in the last 7 days and 77 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123531, was published on 8 November 2026. 35 vulnerabilities in the last four weeks, down 5% on the four before (37). ## Counts - Last 7 days: 29 - Last 30 days: 35 - Last 90 days: 77 - All time: 91 (2 critical, 0 exploited in the wild) ## About Vikunja Vikunja is an open-source project management and task management web application. ## Latest Vikunja vulnerabilities - [CVE-2026-123531: Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled) (high, CVSS 8.8, published 8 Nov 2026) - [CVE-2026-123530: Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication) (medium, CVSS 5.9, published 8 Nov 2026) - [CVE-2026-123529: Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection) (medium, CVSS 4.6, published 8 Nov 2026) - [CVE-2026-123528: Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration) (medium, CVSS 6.8, published 8 Nov 2026) - [CVE-2026-123527: Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass) (medium, CVSS 5.4, published 8 Nov 2026) - [CVE-2026-123526: Vikunja mass assignment in team external_id field](https://junglewise.ai/threats/cve-2026-123526-vikunja-before-2-7-1-contains-a-mass-assignment-vulnerability) (medium, CVSS 5.4, published 8 Nov 2026) - [CVE-2026-123525: Vikunja unbounded memory allocation in migration importers](https://junglewise.ai/threats/cve-2026-123525-vikunja-before-2-7-1-allocates-memory-without-limits-in-its) (medium, CVSS 6.5, published 8 Nov 2026) - [CVE-2026-123524: Vikunja information disclosure via webhook related_tasks](https://junglewise.ai/threats/cve-2026-123524-vikunja-from-0-23-0-before-2-7-1-contains-an-information) (medium, CVSS 5.7, published 8 Nov 2026) - [CVE-2026-123523: Vikunja uncontrolled resource consumption in avatar cache](https://junglewise.ai/threats/cve-2026-123523-vikunja-before-2-7-1-contains-an-uncontrolled-resource) (medium, CVSS 6.5, published 8 Nov 2026) - [CVE-2026-123522: Vikunja authorization bypass in Kanban task webhook](https://junglewise.ai/threats/cve-2026-123522-vikunja-before-2-7-1-contains-an-authorization-bypass) (high, CVSS 7.1, published 8 Nov 2026) - [CVE-2026-123521: Vikunja improper restriction of excessive authentication attempts](https://junglewise.ai/threats/cve-2026-123521-vikunja-before-2-7-1-contains-an-improper-restriction-of) (medium, CVSS 5.9, published 8 Nov 2026) - [CVE-2026-123520: Vikunja privilege escalation via account deletion](https://junglewise.ai/threats/cve-2026-123520-vikunja-from-0-18-0-before-2-7-1-contains-a-privilege-escalation) (high, CVSS 7.1, published 8 Nov 2026) - [CVE-2026-123518: Vikunja authorization bypass in kanban task-bucket move](https://junglewise.ai/threats/cve-2026-123518-vikunja-before-2-7-1-contains-an-incorrect-authorization) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-123516: Vikunja resource exhaustion in ZIP file importer](https://junglewise.ai/threats/cve-2026-123516-vikunja-before-2-7-1-contains-a-resource-exhaustion) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-123515: Vikunja client-side request forgery in rich-text images](https://junglewise.ai/threats/cve-2026-123515-vikunja-before-2-7-1-contains-a-client-side-request-forgery) (medium, CVSS 4.1, published 8 Nov 2026) - [CVE-2026-123514: Vikunja improper resource cleanup in export archives](https://junglewise.ai/threats/cve-2026-123514-vikunja-before-2-7-1-contains-an-improper-resource-cleanup) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-123513: Vikunja credential exposure via API URL change](https://junglewise.ai/threats/cve-2026-123513-vikunja-before-2-7-1-contains-a-credential-exposure) (medium, CVSS 6.8, published 8 Nov 2026) - [CVE-2026-123512: Vikunja authentication tokens in URL query string leaking to access logs](https://junglewise.ai/threats/cve-2026-123512-vikunja-before-2-7-1-embeds-live-password-reset-email) (medium, CVSS 6.1, published 8 Nov 2026) - [CVE-2026-123511: Vikunja uncontrolled resource consumption in CalDAV](https://junglewise.ai/threats/cve-2026-123511-vikunja-before-2-7-1-contains-an-uncontrolled-resource) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-123509: Vikunja uncontrolled resource consumption in kanban buckets](https://junglewise.ai/threats/cve-2026-123509-vikunja-before-2-7-1-contains-an-uncontrolled-resource) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-123506: Vikunja authorization bypass in webhook API scope](https://junglewise.ai/threats/cve-2026-123506-vikunja-from-2-2-0-before-2-7-1-contains-an-authorization-bypass) (medium, CVSS 5.4, published 8 Nov 2026) - [CVE-2026-123505: Vikunja insecure file permissions in local storage](https://junglewise.ai/threats/cve-2026-123505-vikunja-before-2-7-1-contains-an-insecure-file-permissions) (medium, CVSS 5.5, published 8 Nov 2026) - [CVE-2026-123504: Vikunja information disclosure in webhook URLs](https://junglewise.ai/threats/cve-2026-123504-vikunja-from-0-22-0-before-2-7-1-contains-an-information) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-123503: Vikunja authorization bypass in bucket deletion](https://junglewise.ai/threats/cve-2026-123503-vikunja-before-2-7-1-contains-an-improper-authorization) (medium, CVSS 5.4, published 8 Nov 2026) - [CVE-2026-123502: Vikunja link-share hash information exposure via request logging](https://junglewise.ai/threats/cve-2026-123502-vikunja-before-2-7-1-contains-an-information-exposure) (medium, CVSS 5.2, published 8 Nov 2026) ## Most severe Vikunja vulnerabilities - [CVE-2026-56765: Vikunja authorization bypass and IDOR in LinkSharing and TaskAttachments](https://junglewise.ai/threats/cve-2026-56765-vikunja-authorization-bypass-and-idor-in-linksharing-and) (critical, CVSS 9.8, published 10 Jul 2026) - [CVE-2026-68582: Vikunja broken object level authorization in task-collection endpoint](https://junglewise.ai/threats/cve-2026-68582-vikunja-broken-object-level-authorization-in-task-collection) (critical, CVSS 6.5, published 2 Aug 2026) - [CVE-2026-123531: Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled) (high, CVSS 8.8, published 8 Nov 2026) - [CVE-2026-35595: Vikunja privilege escalation via project reparenting](https://junglewise.ai/threats/cve-2026-35595-vikunja-privilege-escalation-via-project-reparenting) (high, CVSS 8.3, published 10 Apr 2026) - [CVE-2026-55065: Vikunja authorization bypass in project view deletion](https://junglewise.ai/threats/cve-2026-55065-vikunja-authorization-bypass-in-project-view-deletion) (high, CVSS 8.1, published 28 Aug 2026) - [CVE-2026-68581: Vikunja API token authentication bypass via link-share ID collision](https://junglewise.ai/threats/cve-2026-68581-vikunja-api-token-authentication-bypass-via-link-share-id) (high, CVSS 8.1, published 2 Aug 2026) - [CVE-2026-57458: Vikunja scoped API token permission bypass in OAuth](https://junglewise.ai/threats/cve-2026-57458-vikunja-scoped-api-token-can-mint-unrestricted-oauth-session) (high, CVSS 8.1, published 9 Oct 2026) - [CVE-2026-62376: Vikunja plaintext storage of authentication tokens in database](https://junglewise.ai/threats/cve-2026-62376-vikunja-plaintext-storage-of-password-reset-email-confirm-tokens) (high, CVSS 8.1, published 9 Oct 2026) - [CVE-2026-91973: Vikunja authentication bypass in CalDAV BasicAuth endpoints](https://junglewise.ai/threats/cve-2026-91973-vikunja-authentication-bypass-in-caldav-basicauth-endpoints) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2026-91972: Vikunja API v2 missing rate limiting on authentication endpoints](https://junglewise.ai/threats/cve-2026-91972-vikunja-api-v2-missing-rate-limiting-on-authentication-endpoints) (high, CVSS 7.5, published 15 Sep 2026) ## Vulnerabilities per week 35 vulnerabilities in the last four weeks, down 5% on the four before (37). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 5 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 23 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 14 | 0 | 0 | | 12 Oct 2026 | 6 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 29 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Vikunja technologies - [Vikunja API](https://junglewise.ai/threats/technologies/vikunja-api): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Vikunja vulnerabilities", https://junglewise.ai/threats/technologies/vikunja, 9 November 2026.