CVE-2026-33678

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial. Version 2.2.1 patches the issue.

• CWE-639

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-jfmm-mjcp-8wq2Exploit, Vendor Advisory
• https://vikunja.io/changelog/vikunja-v2.2.2-was-releasedRelease Notes

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33672Picomatch is a glob matcher written JavaScript. Versions pri…5.3
• CVE-2026-33673PrestaShop is an open source e-commerce web application. Ver…5.4
• CVE-2026-33674PrestaShop is an open source e-commerce web application. Ver…5.3
• CVE-2026-33675Vikunja is an open-source self-hosted task management platfo…5.4
• CVE-2026-33676Vikunja is an open-source self-hosted task management platfo…6.5
• CVE-2026-33677Vikunja is an open-source self-hosted task management platfo…6.5
• CVE-2026-33679Vikunja is an open-source self-hosted task management platfo…7.4
• CVE-2026-3368The Injection Guard plugin for WordPress is vulnerable to St…7.2
• CVE-2026-33680Vikunja is an open-source self-hosted task management platfo…6.5
• CVE-2026-33681WWBN AVideo is an open source video platform. In versions up…7.2
• CVE-2026-33682Streamlit is a data oriented application development framewo…4.8
• CVE-2026-33683WWBN AVideo is an open source video platform. In versions up…5.4