VulnerabilityAnalyzed

CVE-2026-33700

An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID.

MEDIUM 6.9EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID. Version 2.2.1 patches the issue.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.21% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: vikunja/vikunja
Source: security-advisories@github.com

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-f95f-77jx-fcjcVendor Advisory
https://vikunja.io/changelog/vikunja-v2.2.2-was-releasedRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.