PT-2026-27451 · Vikunja · Vikunja

Restriction · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33678

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.2.1

Description Vikunja is a self-hosted task management platform. A flaw exists where the TaskAttachment.ReadOne() function queries attachments using only the ID, disregarding the task ID from the URL. The permission check in CanRead() verifies access to the task in the URL, but ReadOne() can load attachments from other tasks. This allows authenticated users to potentially download or delete any attachment by manipulating the task ID. Attachment IDs are sequential integers, simplifying the process of identifying them. The function TaskAttachment.ReadOne() is vulnerable.

Recommendations Update to version 2.2.1 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33678

Affected Products

Vikunja

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33678 · Security Note
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-jfmm-mjcp-8wq2 · Note
• https://twitter.com/cyberbivash/status/2036492728834363479 · Twitter Post
• https://vikunja.io/changelog/vikunja-v2.2.2-was-released · Note