CVE-2026-33676 Details
Description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.
A vulnerability in Vikunja prior to version 2.2.1 allows authenticated users to access full details of tasks in projects they do not have permission to view. This issue arises because the API fails to check project read permissions when returning related tasks. As a result, users can inadvertently gain access to sensitive task information from private projects, undermining the platform's access control measures.
Users can update to Vikunja version 2.2.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v | CISA-ADP | ExploitVendor Advisory |
| https://github.com/go-vikunja/vikunja/commit/833f2aec006ac0f6643c41872e45dd79220b9174 | [email protected] | Patch |
| https://github.com/go-vikunja/vikunja/pull/2449 | [email protected] | Issue Tracking |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v | [email protected] | ExploitVendor Advisory |
| https://vikunja.io/changelog/vikunja-v2.2.2-was-released | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja vikunja | < 2.2.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | New CVE Received | [email protected] |