{"id":"GHSA-m687-p538-r5hp","kind":"vulnerability","aliases":["GHSA-m687-p538-r5hp","GO-2026-6739"],"related":[],"title":"Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api","description":"Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .","summary":"Vikunja's Go API module (code.vikunja.io/api) has a permissive cross-origin policy that trusts every localhost origin. A malicious page served from any localhost origin may be allowed to make cross-origin requests to the API.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:25+00:00","updated_at":"2026-10-23T20:15:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T20:15:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Vikunja's Go API module (code.vikunja.io/api) has a permissive cross-origin policy that trusts every localhost origin. A malicious page served from any localhost origin may be allowed to make cross-origin requests to the API.","category":"package","who_cares":["go","vikunja","self-hosted"],"confidence":0.5,"analyst_note":"Sources do not list fixed versions or the exact affected range; check https://pkg.go.dev/vuln/GO-2026-6739 and the GHSA-m687-p538-r5hp advisory for fixed version and exploitability conditions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000341,"input_tokens":2095,"output_tokens":263,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':27A '-6739':28A '/api':20A,36A '/api)':50B '/api.':102C 'addit':111C,143C 'advisori':106C 'affect':144C 'allow':73B 'api':46B,82B 'automat':117C 'caus':127C 'code.vikunja.io':19A,35A,49B,101C 'code.vikunja.io/api':18A,34A 'code.vikunja.io/api)':48B 'code.vikunja.io/api.':100C 'contain':110C 'could':114C 'cross':4A,55B,77B,86C 'cross-domain':3A,85C 'cross-origin':54B,76B 'domain':5A,87C 'edit':138C 'everi':9A,60B,91C 'fals':129C 'false-posit':128C 'ghsa':22A,30A 'ghsa-m687-p538-r5hp':21A,29A 'go':26A,37B,45B,121C 'host':41B 'localhost':10A,61B,69B,92C 'm687':23A,31A 'make':75B 'malici':64B 'map':118C 'may':71B 'modul':47B,122C,145C 'note':103C 'origin':11A,56B,62B,70B,78B,93C 'p538':24A,32A 'packag':38B 'page':65B 'permiss':2A,53B,84C 'pleas':135C 'polici':7A,57B,89C 'posit':130C 'r5hp':25A,33A 'report':109C,131C,141C 'request':79B 'scanner':134C 'secur':6A,88C 'self':40B 'self-host':39B 'serv':66B 'sourc':105C 'standard':120C 'suggest':136C 'trust':8A,16A,59B,90C,98C 'version':112C,123C,147C 'vikunja':1A,42B,43B,83C 'vulner':133C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6739","url":"https://pkg.go.dev/vuln/GO-2026-6739","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}