CVE-2026-33313CWE-639

Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

Medium · published March 24, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-24T14:50Z
EPSS history
Timeline
  • 24 MAR 14:50Z
    Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
    cvelistv5