Vulnerability Report: GO-2026-4847
- CVE-2026-33676, GHSA-8cmm-j6c4-rr8v
- Affects: code.vikunja.io/api
- Published: Mar 26, 2026
- Unreviewed
Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: code.vikunja.io/api before v2.2.1.
For detailed information about this vulnerability, visit https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v or https://nvd.nist.gov/vuln/detail/CVE-2026-33676.
Affected Modules
-
PathGo VersionsCustom Versions*
-
all versions, no known fixedbefore 2.2.1
*Custom versions, which can't be mapped automatically to standard Go module versions, are ignored by govulncheck. (See this note on versions for more details.)
Aliases
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v
- https://nvd.nist.gov/vuln/detail/CVE-2026-33676
- https://github.com/go-vikunja/vikunja/commit/833f2aec006ac0f6643c41872e45dd79220b9174
- https://github.com/go-vikunja/vikunja/pull/2449
- https://vikunja.io/changelog/vikunja-v2.2.2-was-released
- https://vuln.go.dev/ID/GO-2026-4847.json