Live › vulnerability › GHSA-w2ch-4xgr-22ww
Go to dashboardVikunja's Go API module (code.vikunja.io/api) does not check read access to the other task when deleting a task relation, so a user can remove relations between tasks in projects they cannot read. The sources do not state the exact privilege or data exposure beyond removing relations across projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Check whether your go.mod pins code.vikunja.io/api below v2.6.0 (run: go list -m code.vikunja.io/api).
Upgrade code.vikunja.io/api to v2.6.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api from v0.9.0 before v2.6.0.
This page as .md · .json · in your agent: get_signal("GHSA-w2ch-4xgr-22ww")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.