Nixpkgs security tracker

Untriaged

Permalink CVE-2026-33313

created 3 weeks ago

Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-mr3j-p26x-72x4 x_refsource_CONFIRM
https://github.com/go-vikunja/vikunja/commit/bc6d843ed4df82a6c89f10aa676a7a33d27bf2fd x_refsource_MISC
https://vikunja.io/changelog/vikunja-v2.2.0-was-released x_refsource_MISC

Affected products

vikunja

==< 2.2.0

Matching in nixpkgs

pkgs.vikunja

Todo-app to organize your life

nixos-unstable 2.1.0
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.2.0
nixos-25.11 2.2.0
- nixos-25.11-small 2.2.0
- nixpkgs-25.11-darwin 2.2.0

pkgs.vikunja-desktop

Desktop App of the Vikunja to-do list app

nixos-unstable 2.1.0
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.2.0

Package maintainers