PT-2026-27449 · Vikunja · Vikunja

Restriction · Published 2026-03-24 · Updated 2026-03-27 · CVE-2026-33676

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.2.1

Description Vikunja is a self-hosted task management platform. Before version 2.2.1, the API, when returning tasks, included complete task objects in the related tasks field without verifying if the user had permission to view the projects those related tasks belonged to. This allowed an authenticated user with access to a task with cross-project relationships to obtain details—including title, description, due dates, priority, percent completion, and project ID—of tasks in projects they were not authorized to access. The API endpoint responsible for returning tasks populates the related tasks field with sensitive information. The vulnerable parameter is related tasks.

Recommendations Upgrade to version 2.2.1 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33676

GHSA-8CMM-J6C4-RR8V

GO-2026-4847

SUSE-SU-2026:1135-1

Affected Products

Vikunja

References · 151

• 🔥 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33676.json · Exploit
• https://github.com/go-vikunja/vikunja/commit/833f2aec006ac0f6643c41872e45dd79220b9174 · Patch
• https://osv.dev/vulnerability/CVE-2026-33676 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4847 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8cmm-j6c4-rr8v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33676 · Security Note
• https://github.com/go-vikunja/vikunja · Note
• https://github.com/go-vikunja/vikunja/pull/2449 · Note
• https://suse.com/security/cve/CVE-2026-33476 · Note
• https://suse.com/security/cve/CVE-2026-26246 · Note
• https://suse.com/security/cve/CVE-2026-32953 · Note
• https://suse.com/security/cve/CVE-2026-33065 · Note
• https://suse.com/security/cve/CVE-2026-32815 · Note