GO-2026-6714None▾ SunlitVikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.
code.vikunja.io/apiRefer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
GO-2026-6754NoneVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api
GO-2026-6732NoneVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.viku…
GHSA-3hc7-r24j-rpwcMediumVikunja: Cross-project task disclosure through subtask expansion
GHSA-g38j-7v97-x298MediumVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
GHSA-w2ch-4xgr-22wwLowVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
GO-2026-6723NoneVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api