PT-2026-27453 · Vikunja · Vikunja

Restriction · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33680

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.2.2

Description Vikunja is a self-hosted task management platform. A flaw exists in the LinkSharing.ReadAll() method where authenticated users with link share access can list all link shares for a project, including their secret hashes. The ReadAllWeb handler bypasses access checks by not calling CanRead(), allowing an attacker with read-only link share access to retrieve hashes for write or admin link shares within the same project. This can lead to escalating privileges to full admin access. The vulnerable function is LinkSharing.ReadAll(). The affected API endpoint is ReadAllWeb.

Recommendations Update to version 2.2.2 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-33680

Affected Products

Vikunja

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-33680 · Security Note
• https://github.com/go-vikunja/vikunja/commit/9efe1fadba817923c7c7f5953c3e9e9c5683bbf3 · Note
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9 · Note
• https://vikunja.io/changelog/vikunja-v2.2.2-was-released · Note
• https://twitter.com/cyberbivash/status/2036492724665254188 · Twitter Post