Live › vulnerability › GHSA-3hc7-r24j-rpwc
Go to dashboardVikunja's Go API module (code.vikunja.io/api) leaks task details across projects when subtasks are expanded. An authenticated user can read tasks in projects they do not have access to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Check the version of code.vikunja.io/api in go.mod; affected versions are before v2.6.0.
Upgrade code.vikunja.io/api to v2.6.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.
This page as .md · .json · in your agent: get_signal("GHSA-3hc7-r24j-rpwc")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.