Verified

ghsa:GHSA-G38J-7V97-X298: code.vikunja.io/api <= 2.5.0

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID. Affected range: <= 2.5.0. Fixed version: 2.6.0.

Affected technology

code.vikunja.io/api · <= 2.5.0
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

An attacker can attach a relation to any task whose UID they know, including tasks in projects they have no access to.

Published 13-Oct-2026 07:48 UTC

Product: code.vikunja.io/api
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-09 22:06:25.045838+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-g38j-7v97-x298.html