CVE-2026-33676

Summary

Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

Severity

medium

EPSS

0.3% (p25)

Also known as

GHSA-8cmm-j6c4-rr8v, GO-2026-4847

Published

2026-03-26

References

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v
• https://nvd.nist.gov/vuln/detail/CVE-2026-33676
• https://github.com/go-vikunja/vikunja/commit/833f2aec006ac0f6643c41872e45dd79220b9174

Related advisories

• CVE-2026-34727 — high · Go/code.vikunja.io/api
• CVE-2026-35595 — medium · Go/code.vikunja.io/api
• CVE-2026-35601 — medium · Go/code.vikunja.io/api
• CVE-2026-40103 — medium · Go/code.vikunja.io/api
• CVE-2026-35602 — medium · Go/code.vikunja.io/api
• CVE-2026-35600 — medium · Go/code.vikunja.io/api
• CVE-2026-35599 — medium · Go/code.vikunja.io/api
• CVE-2026-35598 — medium · Go/code.vikunja.io/api

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity