Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

Vikunja before 2.6.0 Denial of Service via Decompression Bomb

Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 Resource Exhaustion via Planka Migration

vikunja before 2.6.0 Resource Exhaustion via CSV Migration

vikunja before 2.6.0 Denial of Service via unbounded filter recursion

Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler

Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

Vikunja Affected by DoS via Image Preview Generation

Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

Vikunja has TOTP Reuse During Validity Window

Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion

Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources

Read-only Vikunja users can delete project background images via broken object-level authorization

Vikunja Affected by XSS Via Task Preview

Vikunja: Project duplication bypasses write-permission check on the target parent project

Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions

Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 User Enumeration via v2 API

vikunja before 2.6.0 Team Enumeration via Project Share

Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Vikunja has Missing Authorization on CalDAV Task Read

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

Vikunja has a 2FA Bypass via Caldav Basic Auth

Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output