VulnSocial

CVE-2026-33678Disclosure(vikunja / vikunja)

LOWCVSS 8.1 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial. Version 2.2.1 patches the issue.

vikunja CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • vikunja

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
vikunja
Products
vikunja

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-24: 3Technical Details · 2026-03-24: 303-24
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Full discourse3 posts
  • The Hacker Wire@TheHackerWire
    General

    🟠 CVE-2026-33678 - High Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from t... https://www.thehackerwire.com/vulnerability/CVE-2026-33678/ https://t.co/YO39zftpAC

    Post summary

    The tweet announces CVE‑2026‑33678 in Vikunja, describing an access‑control flaw where attachment queries ignore task IDs, but it provides neither proof of exploitation nor remediation guidance.

    0000044
    145 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33678 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ig… https://www.cve.org/CVERecord?id=CVE-2026-33678

    Post summary

    The post highlights a potential authorization flaw in Vikunja's TaskAttachment.ReadOne method before version 2.2.1, providing technical details but no evidence of exploitation or fixes.

    0000073
    56.8K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33678 - Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion Intel Report: https://ift.tt/rMBpFow

    Post summary

    The tweet announces the disclosure of an IDOR flaw (CVE-2026-33678) in Vikunja that permits cross‑project file access and deletion. No PoC, exploit code, patch, or evidence of active exploitation is mentioned.

    0000064
    286 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appvikunjavikunja---

Explore more

Back to dashboardvikunja CVEsvikunja vulnerabilities