CVE-2026-33313

MEDIUM

4.3

Beschreibung

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.

CVE Details

CVSS v3.1 Bewertung4.3

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht3/24/2026

Zuletzt geandert3/24/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

vikunja:vikunja

Schwachen (CWE)

CWE-639

Referenzen

https://github.com/go-vikunja/vikunja/commit/bc6d843ed4df82a6c89f10aa676a7a33d27bf2fd(security-advisories@github.com)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-mr3j-p26x-72x4(security-advisories@github.com)

https://vikunja.io/changelog/vikunja-v2.2.0-was-released(security-advisories@github.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.