CVE-2026-29794CWE-807

Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

Medium · published March 20, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to the rate-limit relying on the value of `(echo.Context).RealIP`. Unauthenticated users can abuse endpoints available to them for different potential impacts. The immediate concern would be brute-forcing usernames or specific accounts' passwords. This bypass allows unlimited requests against unauthenticated endpoints. Version 2.2.0 patches the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.5th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-03-20T14:39Z
EPSS history
Timeline
  • 20 MAR 14:39Z
    Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers
    cvelistv5