Loading story…
A critical broken object level authorization flaw tracked as CVE-2026-68582 affects Vikunja versions 0.24.0 through 2.3.0, allowing remote attackers with any project share link to access kanban bucket metadata from other tenants. The issue resides in the task-collection endpoint, where Vikunja loads a project view from the URL path without confirming the caller is authorized for that view. Exposed data can include bucket titles and full created_by user objects containing username, name, and ID.
The same authorization weakness also creates a project and view ID existence oracle, as attackers can distinguish valid from invalid resources through 404 versus non-404 responses using either link-share access or ordinary authenticated accounts. Reports note that task contents remain restricted to the shared project and are not disclosed through this bug. The vulnerability is remotely exploitable and has been fixed in Vikunja 2.4.0.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability record for CVE-2026-68582 was published describing a critical authorization flaw in Vikunja's task-collection endpoint. The record states the issue is remotely exploitable and affects Vikunja versions 0.24.0 through 2.3.0.
Vikunja fixed a broken object level authorization vulnerability affecting versions 0.24.0 through 2.3.0 in release 2.4.0. The flaw allowed project share-link holders to read kanban bucket metadata from other tenants and exposed a project/view ID existence oracle.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vikunja versions before **2.2.1** are affected by a chained vulnerability tracked as `CVE-2026-56765` that can expose data across an entire instance. The issue combines an authorization weakness in the `LinkSharing.ReadAll` endpoint, which discloses share hashes to users with read access, with an insecure direct object reference in `GetTaskAttachment`, which checks permissions against a user-supplied task ID but retrieves attachments by sequential ID without verifying ownership.
Jul 10, 2026
Two server-side request forgery vulnerabilities were disclosed in widely deployed application servers, allowing attackers to use exposed systems to reach internal-only resources. **Vikunja** is affected by `CVE-2026-33675`, a medium-severity flaw with a CVSS v3.1 score of **6.4** that requires authentication but can let a user read data from services on the same internal network. **Arcane** is affected by `CVE-2026-40242`, a higher-severity issue scored **7.2** that requires no authentication and allows external attackers to send HTTP `GET` requests into internal network zones through the server’s template fetch mechanism. The disclosures warn that both flaws can expose sensitive infrastructure that is normally unreachable from the internet, including cloud instance metadata endpoints, internal administrative interfaces, unauthenticated databases, Docker APIs, Redis services, and vulnerable microservices. In cloud environments, access to metadata services could reveal temporary IAM credentials, user-data scripts, and configuration variables that support lateral movement or privilege escalation. Arcane said the issue was patched in version **1.17.3** with tighter network boundaries, authentication checks, and sanitized error handling, while Vikunja’s flaw remains notable because it can undermine confidentiality even without directly enabling remote code execution.
Jun 29, 2026
A critical improper authorization vulnerability tracked as **`CVE-2026-12686`** has been disclosed in **Adiss’s Biloop** platform. According to the advisory published by **INCIBE-CERT**, the flaw allows an authenticated user to alter a company ID parameter in a backend `POST` request because the application fails to verify that the requested company belongs to the user’s active session within the same subdomain environment. Successful exploitation can enable **cross-tenant access** to other customers’ data, exposing sensitive information such as **billing records** and potentially allowing unauthorized modification of third-party data. The issue is described as **remotely exploitable** and carries a **CVSS 4.0 score of 9.3**, placing it in the **critical** severity range.
Jul 6, 2026