---
id: GO-2026-6732
aliases:
  - GHSA-g38j-7v97-x298
title: >-
  Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an
  unauthorized write into any task by known UID in code.viku…
summary: >-
  Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an
  unauthorized write into any task by known UID in code.vikunja.io/api
severity: none
vendor: api
product: code.vikunja.io/api
ecosystem: go
affected:
  - code.vikunja.io/api
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T21:31:52.830306515Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6732'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g38j-7v97-x298
  - url: >-
      https://github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2
  - url: 'https://github.com/go-vikunja/vikunja/pull/3688'
  - url: 'https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0'
tags:
  - osv
  - go
ingestedAt: '2026-10-21T11:54:42.766Z'
---

## Overview

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.

## Affected packages

- `code.vikunja.io/api`

## Remediation

Refer to the advisory for the patched release.