CVE-2026-33678

High

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial. Version 2.2.1 patches the issue.

SeverityHigh

CVSS8.1

Exploit probability—

ProductVikunja

PublishedMar 24, 2026

First seenMar 24, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

vikunja vikunja2.2.1 or later
code.vikunja.io/api2.2.1 or later

Affected products

Product	Affected versions	Fixed in
vikunja vikunja	v < 2.2.1	2.2.1
code.vikunja.io/apiGo	v < 2.2.1, No range specified	2.2.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.