Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation

Vikunja Affected by Privilege Escalation via Project Reparenting

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections

Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

Vikunja has Path Traversal in CLI Restore

Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja has a File Size Limit Bypass via Vikunja Import

Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

Vikunja before 2.6.0 Denial of Service via Decompression Bomb

Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 Resource Exhaustion via Planka Migration

vikunja before 2.6.0 Resource Exhaustion via CSV Migration

vikunja before 2.6.0 Denial of Service via unbounded filter recursion

Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler

Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

Vikunja Affected by DoS via Image Preview Generation

Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

Vikunja has TOTP Reuse During Validity Window

Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion

Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources

Read-only Vikunja users can delete project background images via broken object-level authorization

Vikunja Affected by XSS Via Task Preview

Vikunja: Project duplication bypasses write-permission check on the target parent project