Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
### Summary `TaskAssginee.ReadAll` returns assignee user objects without blanking the `Email` field, disclosing assignee
#go
共收录 737 条相关情报。
← 返回所有主题Vikunja: Cross-project task disclosure through subtask expansion
### Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project'
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
### Summary Creating a task relation over CalDAV does not run the `TaskRelation.CanCreate` permission check that the RES
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
CVE-2026-91970
# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The al
Vikunja: Unbounded CSV row cardinality permits API process termination
CVE-2026-91969
# Unbounded CSV row cardinality permits API process termination ## Summary The authenticated v2 CSV migration route ca
Vikunja: Unbounded nested task-filter recursion permits API process termination
CVE-2026-91968
# Unbounded nested task-filter recursion permits API process termination ## Summary Authenticated task-list routes acc
Vikunja: Denial of service via decompression bomb in the data import
CVE-2026-91979
### Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archiv
Vikunja: Link-share token can enumerate users through the v2 API
CVE-2026-91981
### Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-s
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
CVE-2026-91980
### Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
CVE-2026-91971
### Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
CVE-2026-91973
### Summary The `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
CVE-2026-91983
## Summary API token permission checks only match the HTTP method and route path. The `expand` query parameter on task
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
CVE-2026-91984
## Summary The task-position endpoint authorizes only the task side of the write: `TaskPosition.CanUpdate` delegates to
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
CVE-2026-91985
## Summary A user who has only read permission on a project can call the single link-share read endpoint and receive th
Vikunja: TOTP secret is readable after enrollment, no step-up auth
CVE-2026-91982
### Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account'
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
CVE-2026-91972
### Summary `registerAPIRoutesV2` never applies the unconditional pre-auth rate-limit floor (`unauthRateLimit()`) to the
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
CVE-2026-62376
### Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table i
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
CVE-2026-62367
## Summary With the per-provider OIDC `emailfallback` option enabled, Vikunja links an SSO login to a pre-existing **lo
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-107806
## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
CVE-2026-107839
### Summary The AoE3 `POST /game/cloud/getFileURL` handler in `luskaner/ageLANServer`'s bundled game server decodes an a