https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:53:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277278 EUVD-2026-277278 https://cve.radiocsirt.org/vuln/euvd-2026-277278 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33676 <p>Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks&#39; projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.</p> <p>Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks&#39; projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33676 https://cve.radiocsirt.org/vuln/ghsa-8cmm-j6c4-rr8v <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>## Summary</p> <p>When the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks&#39; projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to.</p> <p>## Details</p> <p>The vulnerability is in `addRelatedTasksToTasks()` at `pkg/models/tasks.go:496-548`. This function is called by `addMoreInfoToTasks()` (line 773) during every task read operation — both project task listings (`GET /api/v1/projects/{id}/views/{id}/tasks`) and single task reads (`GET /api/v1/tasks/{id}`).</p> <p>The function fetches all related tasks directly from the database without any permission filtering:</p> <p>```go // pkg/models/tasks.go:496-548 func addRelatedTasksToTasks(s *xorm.Session, taskIDs []int64, taskMap map[int64]*Task, a web.Auth) (err error) { relatedTasks := []*TaskRelation{} err = s.In(&#34;task_id&#34;, taskIDs).Find(&amp;relatedTasks) // ... fullRelatedTasks := make(map[int64]*Task) err = s.In(&#34;id&#34;, relatedTaskIDs).Find(&amp;fullRelatedTasks) // Line 514: NO permission check // ... for _, rt := range relatedTasks { // Directly adds to response without checking if user can read the related task taskMap[rt.TaskID].RelatedTasks[rt.RelationKind] = append( taskMap[rt.TaskID].…</p> <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>## Summary</p> <p>When the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks&#39; projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to.</p> <p>## Details</p> <p>The vulnerability is in `addRelatedTasksToTasks()` at `pkg/models/tasks.go:496-548`. This function is called by `addMoreInfoToTasks()` (line 773) during every task read operation — both project task listings (`GET /api/v1/projects/{id}/views/{id}/tasks`) and single task reads (`GET /api/v1/tasks/{id}`).</p> <p>The function fetches all related tasks directly from the database without any permission filtering:</p> <p>```go // pkg/models/tasks.go:496-548 func addRelatedTasksToTasks(s *xorm.Session, taskIDs []int64, taskMap map[int64]*Task, a web.Auth) (err error) { relatedTasks := []*TaskRelation{} err = s.In(&#34;task_id&#34;, taskIDs).Find(&amp;relatedTasks) // ... fullRelatedTasks := make(map[int64]*Task) err = s.In(&#34;id&#34;, relatedTaskIDs).Find(&amp;fullRelatedTasks) // Line 514: NO permission check // ... for _, rt := range relatedTasks { // Directly adds to response without checking if user can read the related task taskMap[rt.TaskID].RelatedTasks[rt.RelationKind] = append( taskMap[rt.TaskID].…</p> https://cve.radiocsirt.org/vuln/ghsa-8cmm-j6c4-rr8v