Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) <= 2.5.0; Vikunja at least through v2.5.0.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Restrict CalDAV access or disable CalDAV sync until patched if task relation integrity in cross-project scenarios is critical to your security model. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vikunja CalDAV relation creation authorization bypass

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Restrict CalDAV access or disable CalDAV sync until patched if task relation integrity in cross-project scenarios is critical to your security model. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · Published 2026-10-09

Vikunja is a project and task management application. A flaw in its CalDAV interface allows authenticated users to attach task relations (subtasks) to any task in the system if they know its internal identifier, even if they have no permission to access that task. The same operation is correctly blocked when attempted through the REST API, exposing a privilege escalation in the CalDAV sync feature.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) <= 2.5.0; Vikunja at least through v2.5.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Restrict CalDAV access or disable CalDAV sync until patched if task relation integrity in cross-project scenarios is critical to your security model. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict CalDAV access or disable CalDAV sync until patched if task relation integrity in cross-project scenarios is critical to your security model.

Technical details

The CalDAV relation creation path in persistRelations() performs an unscoped UID lookup and calls rel.Create() directly without invoking the TaskRelation.CanCreate permission check that the REST API enforces. The REST API correctly returns 403 Forbidden for the same operation. An authenticated attacker with knowledge of a task's UID can create subtask/parent relations to arbitrary tasks across project boundaries, enabling both unauthorized writes and chained cross-project data disclosure.

Affected products

Vikunja Vikunja at least through v2.5.0

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.