CVE-2026-33680
Vikunja is an open-source self-hosted task management platform.
Published Mar 24, 2026 · updated Jun 17, 2026 · vikunja vikunja
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the method allows link share authenticated users to list all link shares for a project, including their secret hashes. While correctly blocks link share users from reading individual shares via , the handler bypasses this check by never calling . An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the method allows link share authenticated users to list all link shares for a project, including their secret hashes. While correctly blocks link share users from reading individual shares via , the handler bypasses this check by never calling . An attacker with a read-only link share can retrieve hashes for w
Jun 17, 2026 · NIST NVD
Updated
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the method allows link share authenticated users to list all link shares for a project, including their secret hashes. While correctly blocks link share users from reading individual shares via , the handler bypasses this check by never calling . An attacker with a read-only link share can retrieve hashes for w
Affected
- cpe vikunja/vikunjaversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33680
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33680
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the method allows link share authenticated users to list all link shares for a project, including their secret hashes. While correctly blocks li
nvd.nist.gov