CVE-2026-29794

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to the rate-limit relying on the value of `(echo.Context).RealIP`. Unauthenticated users can abuse endpoints available to them for different potential impacts. The immediate concern would be brute-forcing usernames or specific accounts' passwords. This bypass allows unlimited requests against unauthenticated endpoints. Version 2.2.0 patches the issue.

• CWE-807

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jxExploit, Vendor Advisory
• https://vikunja.io/changelog/vikunja-v2.2.0-was-releasedRelease Notes

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29789Vito is a self-hosted web application that helps manage serv…8.8
• CVE-2026-2979A flaw has been found in FastApiAdmin up to 2.2.0. This issu…8.8
• CVE-2026-29790dbt-common is the shared common utilities for dbt-core and a…5.3
• CVE-2026-29791Agentgateway is an open source data plane for agentic AI con…6.5
• CVE-2026-29792Feathersjs is a framework for creating web APIs and real-tim…9.8
• CVE-2026-29793Feathersjs is a framework for creating web APIs and real-tim…9.8
• CVE-2026-29795stellar-xdr is a library and CLI containing types and functi…7.5
• CVE-2026-29796WebSocket endpoints lack proper authentication mechanisms, e…9.8
• CVE-2026-2980A vulnerability has been found in UTT HiPER 810G up to 1.7.7…7.3
• CVE-2026-2981A vulnerability was found in UTT HiPER 810G up to 1.7.7-1711…8.8
• CVE-2026-29828DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerabili…6.1
• CVE-2026-2983A vulnerability was determined in SourceCodester Student Res…9.8