CVE-2026-33313
published 2026-03-24CVE-2026-33313: Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.25%
16.6th percentile
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.vikunja.io | api | 0 – 2.1.0 | — |
| go-vikunja | vikunja | < 2.2.0 | 2.2.0 |
| vikunja | vikunja | < 2.2.0 | 2.2.0 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api
osv·2026-03-23
CVE-2026-33313 Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api
OSV
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
osv·2026-03-20
CVE-2026-33313 [MEDIUM] Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
An authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to.
## Details
The `GET /api/v1/tasks/{taskID}/comments/{commentID}` endpoint performs an authorization check against the task ID provided in the URL path, then loads the comment by its own ID without verifying it belongs to that task.
### Root Cause
In `pkg/models/task_comment_permissions.go`, `CanRead` constructs a `Task` using the `TaskID` from the URL and checks `Task.CanRead`:
```go
func (tc *TaskComment) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
t := Task{ID: tc.TaskID}
return t.CanRead(s, a
GHSA
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
ghsa·2026-03-20
CVE-2026-33313 [MEDIUM] CWE-639 Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
An authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to.
## Details
The `GET /api/v1/tasks/{taskID}/comments/{commentID}` endpoint performs an authorization check against the task ID provided in the URL path, then loads the comment by its own ID without verifying it belongs to that task.
### Root Cause
In `pkg/models/task_comment_permissions.go`, `CanRead` constructs a `Task` using the `TaskID` from the URL and checks `Task.CanRead`:
```go
func (tc *TaskComment) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
t := Task{ID: tc.TaskID}
return t.CanRead(s, a
No detection rules found.
No public exploits indexed.
2026-03-24
Published