Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-24 | 2 | Disclosure1General1 |
| 2026-03-31 | 1 | Disclosure1 |
A hash disclosure vulnerability in `Vikjuna` (CVE-2026-33680) enables permission escalation. Assess your exposure. #infosec #vulnerability #Vikjuna https://www.pulsepatch.io/posts/cve-2026-33680-vikjuna-hash-disclosure
Post summary
The tweet announces the disclosure of a hash‑disclosure vulnerability in Vikjuna (CVE-2026-33680) that enables permission escalation, without providing PoC, exploit, or patch details.
CVE-2026-33680 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to li… https://www.cve.org/CVERecord?id=CVE-2026-33680
Post summary
A CVE has been reported for Vikunja’s LinkSharing.ReadAll() method, allowing certain operations, but no PoC, exploit code, or patch information is provided.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33680 - Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation Intel Report: https://ift.tt/fk6Ic3P
Post summary
The post announces CVE‑2026‑33680 affecting Vikunja, describing a hash disclosure through the ReadAll endpoint that permits permission escalation, and links to an intel report, but offers no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vikunja | vikunja | - | - | - |