1. Home
  2. CVE Database
  3. CVE-2026-33313
MEDIUM · 4.3

CVE-2026-33313

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the co...

Vulnerability Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
VikunjaVikunja< 2.2.0

Related Weaknesses (CWE)

CWE-639

References

FAQ

What is CVE-2026-33313?

CVE-2026-33313 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the co...

How severe is CVE-2026-33313?

CVE-2026-33313 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-33313?

Check the references section above for vendor advisories and patch information. Affected products include: Vikunja Vikunja.