Repository navigation
Security: go-vikunja/vikunja
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushesGHSA-4hv6-xc92-j86g published
Oct 3, 2026 by kolaenteModerate -
Saved filter creation with an empty filter string recalculates task positions across all tenantsGHSA-fprf-r6rv-xg99 published
Oct 3, 2026 by kolaenteModerate -
Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feedGHSA-hjx8-qv73-f7cm published
Oct 3, 2026 by kolaenteModerate -
Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)GHSA-pjr3-86v4-5p7w published
Oct 3, 2026 by kolaenteModerate -
Write-level project members can delete admin-tier link shares through an unloaded permission checkGHSA-fmmf-xq98-g327 published
Oct 3, 2026 by kolaenteModerate -
Permissive Cross-domain Security Policy trusts every localhost origin which should not be trustedGHSA-m687-p538-r5hp published
Oct 3, 2026 by kolaenteHigh -
Unbounded nested task-filter recursion permits API process terminationGHSA-xxc3-xpmc-vmvr published
Aug 31, 2026 by kolaenteHigh -
Unbounded CSV row cardinality permits API process terminationGHSA-pqf9-h8g4-8gmh published
Aug 31, 2026 by kolaenteHigh -
Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the APIGHSA-wq92-8x3r-fm38 published
Aug 31, 2026 by kolaenteHigh -
Unbounded image decode on avatar and project-background uploads enables decode/resize amplificationGHSA-4vh2-39rq-rq8j published
Aug 31, 2026 by kolaenteModerate
Learn more about advisories related to go-vikunja/vikunja in the GitHub Advisory Database