Get real-time updates on Telegram
Verified
ghsa:GHSA-M687-P538-R5HP: code.vikunja.io/api >= 2.2.0, <= 2.6.0
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted. Affected range: >= 2.2.0, <= 2.6.0.
Affected technology
code.vikunja.io/api · >= 2.2.0, <= 2.6.0
Vendor not specified by the source
Component: Not specified by the source
Function: is
What an attacker can do
The source does not specify what an attacker can achieve.
- Product
- code.vikunja.io/api
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-09 22:06:25.045838+00:00 UTC
Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-m687-p538-r5hp.html