GHSA-g38j-7v97-x298: Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

October 9, 2026

Creating a task relation over CalDAV does not run the TaskRelation.CanCreate permission check that the REST API enforces. An attacker can attach a relation to any task whose UID they know, including tasks in projects they have no access to. The identical operation over REST is correctly refused with 403.

References

github.com/advisories/GHSA-g38j-7v97-x298
github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2
github.com/go-vikunja/vikunja/pull/3688
github.com/go-vikunja/vikunja/releases/tag/v2.6.0
github.com/go-vikunja/vikunja/security/advisories/GHSA-g38j-7v97-x298

Code Behaviors & Features

Detect and mitigate GHSA-g38j-7v97-x298 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →