Vulnerability GO-2026-6733
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
October 19, 2026 at 09:08 PM UTC
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api
v0.22.0 - v0.24.6
v0.22.0 - v0.24.6
Summary
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api
Details
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
5 hours ago
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6711
v0.13.1 - v0.24.6 GO-2026-6711
Unknown
5 hours ago
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6713
v0.13.1 - v0.24.6 GO-2026-6713
Unknown
5 hours ago
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6714
v0.13.1 - v0.24.6 GO-2026-6714
Unknown
5 hours ago
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6715
v0.13.1 - v0.24.6 GO-2026-6715
Unknown
5 hours ago
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api
v0.13.1 - v0.24.6 GO-2026-6717
v0.13.1 - v0.24.6 GO-2026-6717
Impacted packages
Timeline
Published
5 hours ago
October 19, 2026 at 09:08 PM UTC
Last Modified
4 hours ago
October 19, 2026 at 09:40 PM UTC