CVE-2026-33700

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID. Version 2.2.1 patches the issue.

PUBLISHED Reserved 2026-03-23 | Published 2026-03-24 | Updated 2026-03-24 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

References

github.com/...ikunja/security/advisories/GHSA-f95f-77jx-fcjc

vikunja.io/changelog/vikunja-v2.2.2-was-released

cve.org (CVE-2026-33700)

nvd.nist.gov (CVE-2026-33700)

Download JSON