Plaintext Credential Exposure in Vikunja Task Management Platform
CVE-2026-33677

6.5MEDIUM

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
24 March 2026

What is CVE-2026-33677?

Vikunja, an open-source task management platform, was found to expose BasicAuth credentials through the GET /api/v1/projects/:project/webhooks endpoint for users with read access. This vulnerability allows unauthorized users to access sensitive basic_auth_user and basic_auth_password values in plaintext, posing a significant risk for the integrity of external webhook integrations. Although the HMAC secret was appropriately masked, the oversight regarding BasicAuth fields compromises the overall security. The issue was resolved in version 2.2.1, which ensures that sensitive information remains protected.

Affected Version(s)

vikunja < 2.2.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
x_refsource_CONFIRM
https://vikunja.io/changelog/vikunja-v2.2.2-was-released
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.