Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, published 9 October 2026.
- Which products and versions are affected?
- code.vikunja.io/api (Go) <= 2.5.0.
- Is there a fix for This vulnerability?
- No fixed version is recorded yet. Restrict or disable cross-project subtask linking, or disable the subtask expansion query parameter until patched. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is This vulnerability attacked?
- It is attacked over the network, in a web application.
- Am I affected?
- Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict or disable cross-project subtask linking, or disable the subtask expansion query parameter until patched.
Technical details
When fetching a project's task list with subtask expansion enabled (?expand[]=subtasks), the API correctly filters the main task list by the caller's project access controls, but fails to apply the same filter when recursively expanding linked subtasks. An attacker can exploit this by requesting subtask expansion on tasks they legitimately access, receiving subtasks from private projects as full objects with titles, descriptions, dates, assignees, labels, and attachment metadata, despite having no authorization to those projects. The vulnerability requires a cross-project subtask link to already exist, typically created by someone with access to both projects.
Affected products
- Vikunja Vikunja
Timeline
- 2026-10-09: disclosed