CVE-2026-33676: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read
When the Vikunja API returns tasks, it populates the related_tasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks’ projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to.
References
- github.com/advisories/GHSA-8cmm-j6c4-rr8v
- github.com/go-vikunja/vikunja
- github.com/go-vikunja/vikunja/commit/833f2aec006ac0f6643c41872e45dd79220b9174
- github.com/go-vikunja/vikunja/pull/2449
- github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v
- nvd.nist.gov/vuln/detail/CVE-2026-33676
- vikunja.io/changelog/vikunja-v2.2.2-was-released
Code Behaviors & Features
Detect and mitigate CVE-2026-33676 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →