CVE-2026-33700

MEDIUM

Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-33700 has a selected CVSS score of 6.9 (medium).

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID. Version 2.2.1 patches the issue.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 24, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

vikunja

Browse go-vikunja / vikunja
CVE List< 2.2.1affected

code.vikunja.io/api

Browse Go / code.vikunja.io/api
GitHub AdvisoryBefore 2.2.1 · Fixed in 2.2.1affected

References

4