VulnerabilityAnalyzed

CVE-2026-33313

Vikunja is an open-source self-hosted task management platform.

MEDIUM 5.3EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: vikunja/vikunja
Source: security-advisories@github.com

References

https://github.com/go-vikunja/vikunja/commit/bc6d843ed4df82a6c89f10aa676a7a33d27bf2fdPatch
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-mr3j-p26x-72x4Vendor Advisory
https://vikunja.io/changelog/vikunja-v2.2.0-was-releasedRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.