{"id":"GHSA-g38j-7v97-x298","kind":"vulnerability","aliases":["GHSA-g38j-7v97-x298","GO-2026-6732"],"related":[],"title":"Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api","description":"Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.6.0.","summary":"Vikunja's CalDAV endpoint lets a user create task relations without the permission check that normally guards that action. An authenticated user who knows the UID of a task they cannot access can write a relation into that task.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["caldav","go","package","self-hosted","vikunja"],"not_affected_if":["caldav-disabled","versions-at-or-above-v2.6.0"],"how_to_check":"Check the Go module version of code.vikunja.io/api in go.mod, e.g. grep 'code.vikunja.io/api' go.mod\nIf the Vikunja server is run from a binary or container, check its version with the release tag used to build it","fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.","status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:28+00:00","updated_at":"2026-10-23T20:15:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.\nunknown for any workaround if upgrading is not possible","summary":"Vikunja's CalDAV endpoint lets a user create task relations without the permission check that normally guards that action. An authenticated user who knows the UID of a task they cannot access can write a relation into that task.","category":"package","who_cares":["vikunja","self-hosted","go","caldav"],"confidence":0.6,"analyst_note":"Confirm whether the CalDAV endpoint is enabled by default and whether the attacker needs any authenticated account, using the advisory at https://pkg.go.dev/vuln/GO-2026-6732 or GHSA-g38j-7v97-x298.","how_to_check":"Check the Go module version of code.vikunja.io/api in go.mod, e.g. grep 'code.vikunja.io/api' go.mod\nIf the Vikunja server is run from a binary or container, check its version with the release tag used to build it\nunknown for whether CalDAV is enabled by default in your deployment","needs_analyst":true,"not_affected_if":["versions-at-or-above-v2.6.0","caldav-disabled"],"severity_if_unknown":"medium"},"cost_usd":0.000426,"input_tokens":2136,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':27A '-6732':28A '/api':20A,36A,151C '/api.':102C '7v97':24A,32A 'access':75B 'action':62B 'addit':111C,143C 'advisori':106C 'affect':144C 'allow':7A,89C 'authent':64B 'automat':117C 'bypass':5A,87C 'caldav':2A,37B,46B,84C 'cannot':74B 'caus':127C 'check':57B 'code.vikunja.io':19A,35A,101C,150C 'code.vikunja.io/api':18A,34A,149C 'code.vikunja.io/api.':100C 'contain':110C 'could':114C 'creat':51B 'creation':4A,86C 'edit':138C 'endpoint':47B 'fals':129C 'false-posit':128C 'g38j':23A,31A 'ghsa':22A,30A 'ghsa-g38j-7v97-x298':21A,29A 'go':26A,38B,121C 'guard':60B 'host':42B 'know':67B 'known':15A,97C 'let':48B 'map':118C 'modul':122C,145C 'normal':59B 'note':103C 'packag':39B 'permiss':56B 'pleas':135C 'posit':130C 'relat':3A,53B,79B,85C 'report':109C,131C,141C 'scanner':134C 'self':41B 'self-host':40B 'sourc':105C 'standard':120C 'suggest':136C 'task':13A,52B,72B,82B,95C 'taskrelation.cancreate':6A,88C 'uid':16A,69B,98C 'unauthor':9A,91C 'user':50B,65B 'v2.6.0':153C 'version':112C,123C,147C 'vikunja':1A,43B,44B,83C 'vulner':133C 'without':54B 'write':10A,77B,92C 'x298':25A,33A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6732","url":"https://pkg.go.dev/vuln/GO-2026-6732","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}