Vulnerability GO-2026-6711
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
October 19, 2026 at 09:08 PM UTC
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api
v0.13.1 - v0.24.6
v0.13.1 - v0.24.6
Summary
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api
Details
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
5 hours ago
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6713
v0.13.1 - v0.24.6 GO-2026-6713
Unknown
5 hours ago
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6714
v0.13.1 - v0.24.6 GO-2026-6714
Unknown
5 hours ago
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6715
v0.13.1 - v0.24.6 GO-2026-6715
Unknown
5 hours ago
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6717
v0.13.1 - v0.24.6 GO-2026-6717
Unknown
5 hours ago
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6721
v0.13.1 - v0.24.6 GO-2026-6721
Impacted packages
Timeline
Published
5 hours ago
October 19, 2026 at 09:08 PM UTC
Last Modified
4 hours ago
October 19, 2026 at 09:31 PM UTC