CVE-2026-33680

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/go-vikunja/vikunja/commit/9efe1fadba817923c7c7f5953c3e9e9c5683bbf3	Patch
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9	Exploit Vendor Advisory
https://vikunja.io/changelog/vikunja-v2.2.2-was-released	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*

History

30 Mar 2026, 13:42

Type	Values Removed	Values Added
CPE		cpe:2.3:a:vikunja:vikunja::::::::
First Time		Vikunja vikunja Vikunja
References	~~() https://github.com/go-vikunja/vikunja/commit/9efe1fadba817923c7c7f5953c3e9e9c5683bbf3 -~~	() https://github.com/go-vikunja/vikunja/commit/9efe1fadba817923c7c7f5953c3e9e9c5683bbf3 - Patch
References	~~() https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9 -~~	() https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9 - Exploit, Vendor Advisory
References	~~() https://vikunja.io/changelog/vikunja-v2.2.2-was-released -~~	() https://vikunja.io/changelog/vikunja-v2.2.2-was-released - Release Notes

Information

Published : 2026-03-24 16:16

Updated : 2026-03-30 13:42

NVD link : CVE-2026-33680

Mitre link : CVE-2026-33680

CVE.ORG link : CVE-2026-33680

JSON object : View

Products Affected

vikunja

vikunja

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-33680", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2026-03-24T16:16:35.570", "references": [{"url": "https://github.com/go-vikunja/vikunja/commit/9efe1fadba817923c7c7f5953c3e9e9c5683bbf3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://vikunja.io/changelog/vikunja-v2.2.2-was-released", "tags": ["Release Notes"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue."}, {"lang": "es", "value": "Vikunja es una plataforma de gesti\u00f3n de tareas de c\u00f3digo abierto autoalojada. Antes de la versi\u00f3n 2.2.2, el m\u00e9todo `LinkSharing.ReadAll()` permite a los usuarios autenticados con un enlace compartido listar todos los enlaces compartidos de un proyecto, incluyendo sus hashes secretos. Si bien `LinkSharing.CanRead()` bloquea correctamente a los usuarios de enlaces compartidos de leer enlaces compartidos individuales a trav\u00e9s de `ReadOne`, el gestor `ReadAllWeb` omite esta verificaci\u00f3n al no llamar nunca a `CanRead()`. Un atacante con un enlace compartido de solo lectura puede recuperar hashes de enlaces compartidos de escritura o de administrador en el mismo proyecto y autenticarse con ellos, escalando a acceso de administrador completo. La versi\u00f3n 2.2.2 corrige el problema."}], "lastModified": "2026-03-30T13:42:38.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79DC3F0A-11CE-4DAA-884D-F285B5D344DD", "versionEndExcluding": "2.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}