CVE-2026-33313 — Authorization Bypass Through User-Controlled Key in Vikunja

CWE-639 — Authorization Bypass Through User-Controlled Key5 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 91.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Go-vikunja VikunjaVikunjaCode.vikunja.io API
Timeline
Latest updateMar 23
PublishedMar 24

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDvikunja/vikunja< 2.2.0
▶CVEListV5go-vikunja/vikunja< 2.2.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api↗2026-03-23
▶
OSV
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments↗2026-03-20
▶
GHSA
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments↗2026-03-20
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33313 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶