CVE-2026-29794: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

March 20, 2026

Unauthenticated users are able to bypass the application’s built-in rate-limits by spoofing the X-Forwarded-For or X-Real-IP headers due to the rate-limit relying on the value of (echo.Context).RealIP.

References

github.com/advisories/GHSA-m547-hp4w-j6jx
github.com/go-vikunja/vikunja
github.com/go-vikunja/vikunja/commit/a498dd69915a006c07e9d82660a2185d7e8136ee
github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx
nvd.nist.gov/vuln/detail/CVE-2026-29794

Code Behaviors & Features

Detect and mitigate CVE-2026-29794 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →