PT-2026-27451 · Vikunja · Vikunja

Restriction · Publicado 2026-03-24 · Atualizado 2026-03-27 · CVE-2026-33678

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.2.1

Description Vikunja is a self-hosted task management platform. A flaw exists where the TaskAttachment.ReadOne() function queries attachments using only the ID, disregarding the task ID from the URL. The permission check in CanRead() verifies access to the task in the URL, but ReadOne() can load attachments from other tasks. This allows authenticated users to potentially download or delete any attachment by manipulating the task ID. Attachment IDs are sequential integers, simplifying the process of identifying them. The function TaskAttachment.ReadOne() is vulnerable.

Recommendations Update to version 2.2.1 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-33678

GHSA-JFMM-MJCP-8WQ2

GO-2026-4853

SUSE-SU-2026:1135-1

Produtos afetados

Vikunja

Referências · 153

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33678.json · Exploit
• https://github.com/go-vikunja/vikunja · Nota
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-jfmm-mjcp-8wq2 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33675 · Nota
• https://suse.com/security/cve/CVE-2026-33223 · Nota
• https://suse.com/security/cve/CVE-2026-32805 · Nota
• https://suse.com/security/cve/CVE-2026-33758 · Nota
• https://suse.com/security/cve/CVE-2026-33067 · Nota
• https://suse.com/security/cve/CVE-2026-32691 · Nota
• https://suse.com/security/cve/CVE-2026-21386 · Nota
• https://suse.com/security/cve/CVE-2026-33219 · Nota
• https://suse.com/security/cve/CVE-2026-33217 · Nota
• https://suse.com/security/cve/CVE-2026-33638 · Nota
• https://suse.com/security/cve/CVE-2026-32938 · Nota
• https://suse.com/security/cve/CVE-2026-33503 · Nota