{"schema_version":1,"title":"Vikunja vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 32 vulnerabilities in Vikunja: 0 in the last 7 days and 21 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91985, was published on 15 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/vikunja","json_url":"https://junglewise.ai/threats/vendors/vikunja.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/vikunja","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":8,"all_time":32,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":18,"last_90_days":21,"last_365_days":32},"latest":[{"cve":"CVE-2026-91985","cvss":7.5,"epss":0.0043,"slug":"cve-2026-91985-vikunja-link-share-hash-disclosure-and-privilege-escalation","title":"Vikunja link-share hash disclosure and privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:57.01+00:00","url":"https://junglewise.ai/threats/cve-2026-91985-vikunja-link-share-hash-disclosure-and-privilege-escalation"},{"cve":"CVE-2026-91984","cvss":4.3,"epss":0.0026,"slug":"cve-2026-91984-vikunja-task-position-authorization-bypass","title":"Vikunja task-position authorization bypass","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:55.903+00:00","url":"https://junglewise.ai/threats/cve-2026-91984-vikunja-task-position-authorization-bypass"},{"cve":"CVE-2026-91983","cvss":4.3,"epss":0.0031,"slug":"cve-2026-91983-vikunja-api-token-scope-bypass-via-expand-parameter","title":"Vikunja API token scope bypass via expand parameter","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:55.373+00:00","url":"https://junglewise.ai/threats/cve-2026-91983-vikunja-api-token-scope-bypass-via-expand-parameter"},{"cve":"CVE-2026-91982","cvss":4.3,"epss":0.0035,"slug":"cve-2026-91982-vikunja-totp-secret-exposure-via-unprotected-api-endpoint","title":"Vikunja TOTP secret exposure via unprotected API endpoint","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:55.227+00:00","url":"https://junglewise.ai/threats/cve-2026-91982-vikunja-totp-secret-exposure-via-unprotected-api-endpoint"},{"cve":"CVE-2026-91981","cvss":4.3,"epss":0.0031,"slug":"cve-2026-91981-vikunja-user-enumeration-via-v2-api-token-validation-bypass","title":"Vikunja user enumeration via v2 API token validation bypass","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:55.087+00:00","url":"https://junglewise.ai/threats/cve-2026-91981-vikunja-user-enumeration-via-v2-api-token-validation-bypass"},{"cve":"CVE-2026-91980","cvss":4.3,"epss":0.0031,"slug":"cve-2026-91980-vikunja-team-enumeration-via-project-share","title":"Vikunja team enumeration via project share","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:54.94+00:00","url":"https://junglewise.ai/threats/cve-2026-91980-vikunja-team-enumeration-via-project-share"},{"cve":"CVE-2026-91979","cvss":6.5,"epss":0.0044,"slug":"cve-2026-91979-vikunja-decompression-bomb-denial-of-service-in-data-import","title":"Vikunja decompression bomb denial of service in data import","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:54.793+00:00","url":"https://junglewise.ai/threats/cve-2026-91979-vikunja-decompression-bomb-denial-of-service-in-data-import"},{"cve":"CVE-2026-91973","cvss":7.5,"epss":0.0067,"slug":"cve-2026-91973-vikunja-authentication-bypass-in-caldav-basicauth-endpoints","title":"Vikunja authentication bypass in CalDAV BasicAuth endpoints","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:54.23+00:00","url":"https://junglewise.ai/threats/cve-2026-91973-vikunja-authentication-bypass-in-caldav-basicauth-endpoints"},{"cve":"CVE-2026-91972","cvss":7.5,"epss":0.0063,"slug":"cve-2026-91972-vikunja-api-v2-missing-rate-limiting-on-authentication-endpoints","title":"Vikunja API v2 missing rate limiting on authentication endpoints","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:54.087+00:00","url":"https://junglewise.ai/threats/cve-2026-91972-vikunja-api-v2-missing-rate-limiting-on-authentication-endpoints"},{"cve":"CVE-2026-91971","cvss":6.5,"epss":0.0044,"slug":"cve-2026-91971-vikunja-avatar-and-project-background-upload-denial-of-service","title":"Vikunja avatar and project-background upload denial of service","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:53.947+00:00","url":"https://junglewise.ai/threats/cve-2026-91971-vikunja-avatar-and-project-background-upload-denial-of-service"},{"cve":"CVE-2026-91970","cvss":6.5,"epss":0.0044,"slug":"cve-2026-91970-vikunja-resource-exhaustion-in-planka-migrator","title":"Vikunja resource exhaustion in Planka migrator","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:53.803+00:00","url":"https://junglewise.ai/threats/cve-2026-91970-vikunja-resource-exhaustion-in-planka-migrator"},{"cve":"CVE-2026-91969","cvss":6.5,"epss":0.0044,"slug":"cve-2026-91969-vikunja-resource-exhaustion-in-csv-migration-endpoint","title":"vikunja resource exhaustion in CSV migration endpoint","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:53.647+00:00","url":"https://junglewise.ai/threats/cve-2026-91969-vikunja-resource-exhaustion-in-csv-migration-endpoint"},{"cve":"CVE-2026-91968","cvss":6.5,"epss":0.0044,"slug":"cve-2026-91968-vikunja-task-filter-resource-exhaustion-via-unbounded-recursion","title":"Vikunja task-filter resource exhaustion via unbounded recursion","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:53.093+00:00","url":"https://junglewise.ai/threats/cve-2026-91968-vikunja-task-filter-resource-exhaustion-via-unbounded-recursion"},{"cve":"CVE-2026-55067","cvss":5,"epss":0.0034,"slug":"cve-2026-55067-vikunja-kanban-bucket-cross-tenant-relocation-via-mass-assignment","title":"Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket","severity":"medium","exploited":false,"published_at":"2026-08-28T20:18:24.037+00:00","url":"https://junglewise.ai/threats/cve-2026-55067-vikunja-kanban-bucket-cross-tenant-relocation-via-mass-assignment"},{"cve":"CVE-2026-55066","cvss":7.1,"epss":0.0037,"slug":"cve-2026-55066-vikunja-task-authorization-bypass-in-bucket-endpoint","title":"Vikunja task authorization bypass in bucket endpoint","severity":"high","exploited":false,"published_at":"2026-08-28T20:18:23.897+00:00","url":"https://junglewise.ai/threats/cve-2026-55066-vikunja-task-authorization-bypass-in-bucket-endpoint"},{"cve":"CVE-2026-55065","cvss":8.1,"epss":0.005,"slug":"cve-2026-55065-vikunja-authorization-bypass-in-project-view-deletion","title":"Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permit","severity":"high","exploited":false,"published_at":"2026-08-28T20:18:23.757+00:00","url":"https://junglewise.ai/threats/cve-2026-55065-vikunja-authorization-bypass-in-project-view-deletion"},{"cve":"CVE-2026-55064","cvss":4.3,"epss":0.0037,"slug":"cve-2026-55064-vikunja-incomplete-privilege-escalation-fix-via-parent-project-id","title":"Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shar","severity":"medium","exploited":false,"published_at":"2026-08-28T20:18:23.613+00:00","url":"https://junglewise.ai/threats/cve-2026-55064-vikunja-incomplete-privilege-escalation-fix-via-parent-project-id"},{"cve":"CVE-2026-54766","cvss":4,"epss":0.0043,"slug":"cve-2026-54766-vikunja-project-duplication-authorization-bypass","title":"Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/pro","severity":"medium","exploited":false,"published_at":"2026-08-28T20:18:17.803+00:00","url":"https://junglewise.ai/threats/cve-2026-54766-vikunja-project-duplication-authorization-bypass"},{"cve":"CVE-2026-68582","cvss":6.5,"epss":0.0036,"slug":"cve-2026-68582-vikunja-broken-object-level-authorization-in-task-collection","title":"Vikunja broken object level authorization in task-collection endpoint","severity":"medium","exploited":false,"published_at":"2026-08-02T13:16:54.233+00:00","url":"https://junglewise.ai/threats/cve-2026-68582-vikunja-broken-object-level-authorization-in-task-collection"},{"cve":"CVE-2026-68581","cvss":8.1,"epss":0.0046,"slug":"cve-2026-68581-vikunja-api-token-authentication-bypass-via-link-share-id","title":"Vikunja API token authentication bypass via link-share ID collision","severity":"high","exploited":false,"published_at":"2026-08-02T13:16:54.087+00:00","url":"https://junglewise.ai/threats/cve-2026-68581-vikunja-api-token-authentication-bypass-via-link-share-id"},{"cve":"CVE-2026-56765","cvss":9.8,"epss":0.0051,"slug":"cve-2026-56765-vikunja-authorization-bypass-and-idor-in-linksharing-and","title":"Vikunja authorization bypass and IDOR in LinkSharing and TaskAttachments","severity":"critical","exploited":false,"published_at":"2026-07-10T15:16:43.727+00:00","url":"https://junglewise.ai/threats/cve-2026-56765-vikunja-authorization-bypass-and-idor-in-linksharing-and"},{"cve":"CVE-2026-40103","cvss":5.4,"epss":0.0035,"slug":"cve-2026-40103-vikunja-authorization-bypass-in-scoped-api-tokens","title":"Vikunja authorization bypass in scoped API tokens","severity":"medium","exploited":false,"published_at":"2026-04-10T17:17:13.143+00:00","url":"https://junglewise.ai/threats/cve-2026-40103-vikunja-authorization-bypass-in-scoped-api-tokens"},{"cve":"CVE-2026-35602","cvss":5.4,"epss":0.0055,"slug":"cve-2026-35602-vikunja-file-size-limit-bypass-in-import-endpoint","title":"Vikunja file size limit bypass in import endpoint","severity":"medium","exploited":false,"published_at":"2026-04-10T17:17:03.993+00:00","url":"https://junglewise.ai/threats/cve-2026-35602-vikunja-file-size-limit-bypass-in-import-endpoint"},{"cve":"CVE-2026-35601","cvss":4.1,"epss":0.0032,"slug":"cve-2026-35601-vikunja-crlf-injection-in-caldav-output-generator","title":"Vikunja CRLF injection in CalDAV output generator","severity":"medium","exploited":false,"published_at":"2026-04-10T17:17:03.837+00:00","url":"https://junglewise.ai/threats/cve-2026-35601-vikunja-crlf-injection-in-caldav-output-generator"},{"cve":"CVE-2026-35600","cvss":5.4,"epss":0.0031,"slug":"cve-2026-35600-vikunja-markdown-injection-in-email-notifications","title":"Vikunja Markdown injection in email notifications","severity":"medium","exploited":false,"published_at":"2026-04-10T17:17:03.68+00:00","url":"https://junglewise.ai/threats/cve-2026-35600-vikunja-markdown-injection-in-email-notifications"}],"vendor":{"hub":true,"name":"Vikunja","slug":"vikunja","homepage":"https://vikunja.io/","description":"Vikunja is an open-source to-do list application for organizing tasks.","url":"https://junglewise.ai/threats/vendors/vikunja"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":13},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-56765","cvss":9.8,"epss":0.0051,"slug":"cve-2026-56765-vikunja-authorization-bypass-and-idor-in-linksharing-and","title":"Vikunja authorization bypass and IDOR in LinkSharing and TaskAttachments","severity":"critical","exploited":false,"published_at":"2026-07-10T15:16:43.727+00:00","url":"https://junglewise.ai/threats/cve-2026-56765-vikunja-authorization-bypass-and-idor-in-linksharing-and"},{"cve":"CVE-2026-35595","cvss":8.3,"epss":0.0046,"slug":"cve-2026-35595-vikunja-privilege-escalation-via-project-reparenting","title":"Vikunja privilege escalation via project reparenting","severity":"high","exploited":false,"published_at":"2026-04-10T17:17:02.91+00:00","url":"https://junglewise.ai/threats/cve-2026-35595-vikunja-privilege-escalation-via-project-reparenting"},{"cve":"CVE-2026-55065","cvss":8.1,"epss":0.005,"slug":"cve-2026-55065-vikunja-authorization-bypass-in-project-view-deletion","title":"Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permit","severity":"high","exploited":false,"published_at":"2026-08-28T20:18:23.757+00:00","url":"https://junglewise.ai/threats/cve-2026-55065-vikunja-authorization-bypass-in-project-view-deletion"},{"cve":"CVE-2026-68581","cvss":8.1,"epss":0.0046,"slug":"cve-2026-68581-vikunja-api-token-authentication-bypass-via-link-share-id","title":"Vikunja API token authentication bypass via link-share ID collision","severity":"high","exploited":false,"published_at":"2026-08-02T13:16:54.087+00:00","url":"https://junglewise.ai/threats/cve-2026-68581-vikunja-api-token-authentication-bypass-via-link-share-id"},{"cve":"CVE-2026-91973","cvss":7.5,"epss":0.0067,"slug":"cve-2026-91973-vikunja-authentication-bypass-in-caldav-basicauth-endpoints","title":"Vikunja authentication bypass in CalDAV BasicAuth endpoints","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:54.23+00:00","url":"https://junglewise.ai/threats/cve-2026-91973-vikunja-authentication-bypass-in-caldav-basicauth-endpoints"},{"cve":"CVE-2026-91972","cvss":7.5,"epss":0.0063,"slug":"cve-2026-91972-vikunja-api-v2-missing-rate-limiting-on-authentication-endpoints","title":"Vikunja API v2 missing rate limiting on authentication endpoints","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:54.087+00:00","url":"https://junglewise.ai/threats/cve-2026-91972-vikunja-api-v2-missing-rate-limiting-on-authentication-endpoints"},{"cve":"CVE-2026-91985","cvss":7.5,"epss":0.0043,"slug":"cve-2026-91985-vikunja-link-share-hash-disclosure-and-privilege-escalation","title":"Vikunja link-share hash disclosure and privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:57.01+00:00","url":"https://junglewise.ai/threats/cve-2026-91985-vikunja-link-share-hash-disclosure-and-privilege-escalation"},{"cve":"CVE-2026-34727","cvss":7.4,"epss":0.0042,"slug":"cve-2026-34727-vikunja-totp-two-factor-authentication-bypass-in-oidc-callback","title":"Vikunja TOTP two-factor authentication bypass in OIDC callback","severity":"high","exploited":false,"published_at":"2026-04-10T16:16:31.853+00:00","url":"https://junglewise.ai/threats/cve-2026-34727-vikunja-totp-two-factor-authentication-bypass-in-oidc-callback"},{"cve":"CVE-2026-55066","cvss":7.1,"epss":0.0037,"slug":"cve-2026-55066-vikunja-task-authorization-bypass-in-bucket-endpoint","title":"Vikunja task authorization bypass in bucket endpoint","severity":"high","exploited":false,"published_at":"2026-08-28T20:18:23.897+00:00","url":"https://junglewise.ai/threats/cve-2026-55066-vikunja-task-authorization-bypass-in-bucket-endpoint"},{"cve":"CVE-2026-35599","cvss":6.5,"epss":0.0058,"slug":"cve-2026-35599-vikunja-algorithmic-complexity-dos-in-repeating-task-handler","title":"Vikunja algorithmic complexity DoS in repeating task handler","severity":"medium","exploited":false,"published_at":"2026-04-10T17:17:03.52+00:00","url":"https://junglewise.ai/threats/cve-2026-35599-vikunja-algorithmic-complexity-dos-in-repeating-task-handler"}],"generated_at":"2026-09-26T16:07:00.132667+00:00","technologies":[{"name":"Vikunja","slug":"vikunja","vulnerabilities":32,"url":"https://junglewise.ai/threats/technologies/vikunja"}]}