Loading story…
Vikunja versions before 2.2.1 are affected by a chained vulnerability tracked as CVE-2026-56765 that can expose data across an entire instance. The issue combines an authorization weakness in the LinkSharing.ReadAll endpoint, which discloses share hashes to users with read access, with an insecure direct object reference in GetTaskAttachment, which checks permissions against a user-supplied task ID but retrieves attachments by sequential ID without verifying ownership.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new vulnerability, CVE-2026-56765, is published describing how the two flaws can be chained to enable unauthenticated instance-wide access to attachments and escalation to admin-level shares. The disclosure classifies the issue as CWE-639 and notes high confidentiality, integrity, and availability impact.
The references state that Vikunja versions before 2.2.1 are affected by a chain involving share hash disclosure in LinkSharing.ReadAll and an attachment IDOR in GetTaskAttachment. Version 2.2.1 is identified as the unaffected release, indicating the issue was fixed by that version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical broken object level authorization flaw tracked as **`CVE-2026-68582`** affects **Vikunja** versions **0.24.0 through 2.3.0**, allowing remote attackers with any project share link to access kanban bucket metadata from other tenants. The issue resides in the task-collection endpoint, where Vikunja loads a project view from the URL path without confirming the caller is authorized for that view. Exposed data can include bucket titles and full `created_by` user objects containing username, name, and ID. The same authorization weakness also creates a project and view ID existence oracle, as attackers can distinguish valid from invalid resources through **404 versus non-404** responses using either link-share access or ordinary authenticated accounts. Reports note that task contents remain restricted to the shared project and are not disclosed through this bug. The vulnerability is remotely exploitable and has been fixed in **Vikunja 2.4.0**.
Aug 2, 2026
Two server-side request forgery vulnerabilities were disclosed in widely deployed application servers, allowing attackers to use exposed systems to reach internal-only resources. **Vikunja** is affected by `CVE-2026-33675`, a medium-severity flaw with a CVSS v3.1 score of **6.4** that requires authentication but can let a user read data from services on the same internal network. **Arcane** is affected by `CVE-2026-40242`, a higher-severity issue scored **7.2** that requires no authentication and allows external attackers to send HTTP `GET` requests into internal network zones through the server’s template fetch mechanism. The disclosures warn that both flaws can expose sensitive infrastructure that is normally unreachable from the internet, including cloud instance metadata endpoints, internal administrative interfaces, unauthenticated databases, Docker APIs, Redis services, and vulnerable microservices. In cloud environments, access to metadata services could reveal temporary IAM credentials, user-data scripts, and configuration variables that support lateral movement or privilege escalation. Arcane said the issue was patched in version **1.17.3** with tighter network boundaries, authentication checks, and sanitized error handling, while Vikunja’s flaw remains notable because it can undermine confidentiality even without directly enabling remote code execution.
Jun 29, 2026
Rapid7 and Microsoft disclosed **`CVE-2026-63520`**, a high-severity remote code execution flaw in Microsoft SharePoint that can be chained with the previously disclosed authentication bypass **`CVE-2026-55040`** to achieve **unauthenticated RCE** on vulnerable on-premises SharePoint servers. The chain affects supported SharePoint versions and also impacts certain versions of Microsoft Project Server and Microsoft Office Web Apps Server, with the initial authentication bypass also reported to affect SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft advised customers to apply the latest updates, and Rapid7 said July updates disrupted the exploit chain while the RCE fix was disclosed separately. Rapid7 said **`CVE-2026-55040`** lets attackers forge JWTs and impersonate SharePoint users or administrators by exploiting multiple weaknesses in SharePoint's token validation pipeline, including inadequate signature enforcement and certificate validation. Attackers can obtain the SharePoint STS signing certificate from an unauthenticated metadata endpoint, craft forged nested JWTs, and access authenticated endpoints before using **`CVE-2026-63520`** in Business Connectivity Services, where unsafe .NET type instantiation enables arbitrary code execution under the SharePoint Site service account. Researchers said the exploit chain was developed during a zero-day research project using AI-assisted workflows, while noting that expert oversight was required throughout the discovery process.
Aug 26, 2026