PT-2026-27454 · Vikunja · Vikunja

Kolaente · Publicado 2026-03-24 · Atualizado 2026-03-27 · CVE-2026-33700

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.2.1

Description Vikunja is a self-hosted task management platform. A flaw exists where the DELETE /api/v1/projects/:project/shares/:share endpoint does not confirm that the link share belongs to the project specified in the URL. An attacker with administrator privileges for any project can delete link shares from other projects by using their own project ID along with the target share ID.

Recommendations Update to version 2.2.1 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-33700

GHSA-F95F-77JX-FCJC

GO-2026-4850

SUSE-SU-2026:1135-1

Produtos afetados

Vikunja

Referências · 152

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33700.json · Exploit
• https://github.com/go-vikunja/vikunja · Nota
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-f95f-77jx-fcjc · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33476 · Nota
• https://suse.com/security/cve/CVE-2026-26246 · Nota
• https://suse.com/security/cve/CVE-2026-32953 · Nota
• https://suse.com/security/cve/CVE-2026-33065 · Nota
• https://suse.com/security/cve/CVE-2026-32815 · Nota
• https://suse.com/security/cve/CVE-2026-33494 · Nota
• https://suse.com/security/cve/CVE-2026-33064 · Nota
• https://suse.com/security/cve/CVE-2026-33247 · Nota
• https://suse.com/security/cve/CVE-2026-33638 · Nota
• https://reddit.com/r/VulnMatter/comments/1s473iq/resumen_diario_de_vulnerabilidades_26032026 · Publicação no Reddit
• https://suse.com/security/cve/CVE-2026-33496 · Nota
• https://suse.com/security/cve/CVE-2026-33729 · Nota