Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-33680: Vikunja task app exposes admin link hashes via read‑all
CVE-2026-33680 · published 7 months ago
Summary
Versions of Vikijna before 2.2.2 let a user who only has a read‑only share view all link shares for a project, including the hidden codes that give higher permissions. By collecting those codes, the user can gain write or admin rights to the same project. Updating to version 2.2.2 stops the unwanted listing and protects the shared links.
What to do
- Update code.vikunja.io api to version 2.2.2.
- Update vikunja vikunja to version 2.2.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | code.vikunja.io | api |
< 2.2.2 Fix: upgrade to 2.2.2
|
| Go | api | code.vikunja.io/api | All versions |
| – | vikunja | vikunja |
< 2.2.2 cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Original advisory text
Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.
References
- https://pkg.go.dev/vuln/GO-2026-4848
- https://vikunja.io/changelog/vikunja-v2.2.2-was-released URL
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9 Vendor Advisory
- https://github.com/go-vikunja/vikunja/commit/9efe1fadba817923c7c7f5953c3e9e9c568... Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-33680 Vendor Advisory
- https://github.com/advisories/GHSA-8hp8-9fhr-pfm9
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33680... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-285Improper Authorization
Timeline
Published24 Mar 2026
Updated4 Nov 2026
First seen24 Mar 2026
Track software like this
Free during beta