Information Disclosure in Vikunja Task Management Platform

CVE-2026-33676

What is CVE-2026-33676?

An information disclosure vulnerability in Vikunja allows authenticated users to retrieve sensitive details regarding tasks from projects to which they do not have access. Specifically, when the Vikunja API returns tasks, it erroneously populates the related_tasks field with complete task objects, including details such as titles, descriptions, due dates, priorities, and project IDs. This oversight can expose private information, impacting user privacy and project security. The issue is resolved in version 2.2.1, which includes checks to ensure that user permissions are enforced appropriately.

References