{"id":"GHSA-3hc7-r24j-rpwc","kind":"vulnerability","aliases":["GHSA-3hc7-r24j-rpwc","GO-2026-6714"],"related":[],"title":"Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api","description":"Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.6.0.","summary":"Vikunja's Go API module (code.vikunja.io/api) leaks task details across projects when subtasks are expanded. An authenticated user can read tasks in projects they do not have access to.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["default-config"],"how_to_check":"Check the version of code.vikunja.io/api in go.mod; affected versions are before v2.6.0.","fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.","status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:24+00:00","updated_at":"2026-10-23T20:15:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:24Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.\nunknown","summary":"Vikunja's Go API module (code.vikunja.io/api) leaks task details across projects when subtasks are expanded. An authenticated user can read tasks in projects they do not have access to.","category":"package","who_cares":["vikunja","go","self-hosted"],"confidence":0.6,"analyst_note":"Sources do not state whether the attacker needs an account or what exact permission check was bypassed; check the GHSA-3hc7-r24j-rpwc advisory and the Vikunja v2.6.0 release notes at https://pkg.go.dev/vuln/GO-2026-6714.","how_to_check":"Check the version of code.vikunja.io/api in go.mod; affected versions are before v2.6.0.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000373,"input_tokens":2090,"output_tokens":328,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A '-6714':21A '/api':13A,29A,127C '/api)':43B '/api.':78C '3hc7':16A,24A 'access':65B 'across':47B 'addit':87C,119C 'advisori':82C 'affect':120C 'api':39B 'authent':54B 'automat':93C 'caus':103C 'code.vikunja.io':12A,28A,42B,77C,126C 'code.vikunja.io/api':11A,27A,125C 'code.vikunja.io/api)':41B 'code.vikunja.io/api.':76C 'contain':86C 'could':90C 'cross':3A,68C 'cross-project':2A,67C 'detail':46B 'disclosur':6A,71C 'edit':114C 'expand':52B 'expans':9A,74C 'fals':105C 'false-posit':104C 'ghsa':15A,23A 'ghsa-3hc7-r24j-rpwc':14A,22A 'go':19A,30B,38B,97C 'host':34B 'leak':44B 'map':94C 'modul':40B,98C,121C 'note':79C 'packag':31B 'pleas':111C 'posit':106C 'project':4A,48B,60B,69C 'r24j':17A,25A 'read':57B 'report':85C,107C,117C 'rpwc':18A,26A 'scanner':110C 'self':33B 'self-host':32B 'sourc':81C 'standard':96C 'subtask':8A,50B,73C 'suggest':112C 'task':5A,45B,58B,70C 'user':55B 'v2.6.0':129C 'version':88C,99C,123C 'vikunja':1A,35B,36B,66C 'vulner':109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6714","url":"https://pkg.go.dev/vuln/GO-2026-6714","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}