Vulnerability details
CVE-2026-33680
go-vikunja vikunja
Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
CVSS 3.1
7.5High
Official description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| go-vikunja | vikunja | < 2.2.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9 x_refsource_CONFIRM
- https://github.com/go-vikunja/vikunja/commit/9efe1fadba817923c7c7f5953c3e9e9c5683bbf3 x_refsource_MISC
- https://vikunja.io/changelog/vikunja-v2.2.2-was-released x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-24
- Last updated
- 2026-03-26
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.4%
Probability of exploitation in 30 days
35%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-285Improper Authorization