CVE-2026-111917Medium· 6.5▾ SunlitVikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers hold…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.
vikunja >= 2.3.0 < 2.7.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111919Medium· 6.5Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
CVE-2026-111918Medium· 5.4Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
CVE-2026-111920Medium· 4.3Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
CVE-2026-111922Medium· 6.3Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
CVE-2026-111921Medium· 5.4Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
CVE-2026-91968Medium· 6.5vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits