Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation

Vikunja Affected by Privilege Escalation via Project Reparenting

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections

Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

Vikunja has Path Traversal in CLI Restore

Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja has a File Size Limit Bypass via Vikunja Import