https://vulnerability.circl.lu/sightings/feed 2026-10-10T23:36:22.067623+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7ad61aea-5508-44f7-83da-77679bced473/export 2026-10-10T23:36:22.072765+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7ad61aea-5508-44f7-83da-77679bced473", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-G38J-7V97-X298", "type": "seen", "source": "https://gist.github.com/alon710/5414d7932fae69531287f4a3f746d67f", "content": "# GHSA-G38J-7V97-X298: GHSA-G38J-7V97-X298: Missing Authorization Check in Vikunja CalDAV Task Relation Creation\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/GHSA-G38J-7V97-X298\n\n## Summary\nIn Vikunja prior to version 2.6.0, relation creation via the CalDAV endpoint fails to invoke the TaskRelation.CanCreate authorization check. This missing access control allows an authenticated user to establish unauthorized relationships and perform write operations against any task, provided its unique identifier (UID) is known.\n\n## TL;DR\nVikunja's CalDAV engine omitted authorization checks when creating task relations, allowing authenticated users with a target task UID to create unauthorized linkages and modify restricted task structures.\n\n## Technical Details\n\n- **CWE Identifier**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (CalDAV Endpoint)\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: N/A (GHSA identifier without CVE mapping)\n- **Impact**: Unauthorized Write / Relation Creation across tasks\n- **Exploit Status**: No public weaponized exploit available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Vikunja backend installations prior to version 2.6.0 running CalDAV services\n- **Vikunja**: < 2.6.0 (Fixed in: `2.6.0`)\n\n## Mitigation\n\n- Upgrade the Vikunja backend deployment to version v2.6.0 or higher.\n- Restrict network access to the CalDAV endpoint (/dav/...) via web application firewall or reverse proxy if patching cannot be immediately performed.\n- Audit database task relations for unexpected cross-user or cross-project links established prior to patching.\n\n**Remediation Steps:**\n1. Pull the latest Vikunja container image or binary release tagged v2.6.0 or later.\n2. Restart the Vikunja backend service to load the updated executable binaries.\n3. Inspect server logs for CalDAV request activity to ensure operational stability after patching.\n\n## References\n\n- [GitHub Security Advisory GHSA-G38J-7V97-X298](https://github.com/advisories/GHSA-G38J-7V97-X298)\n- [Vikunja GitHub Repository](https://github.com/go-vikunja/vikunja)\n- [Vikunja Pull Request #3688](https://github.com/go-vikunja/vikunja/pull/3688)\n- [Fix Commit 077dc4de79ce6f1ab59215a2c7bf9b30423685f2](https://github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2)\n- [Vikunja Release v2.6.0](https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-G38J-7V97-X298) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-10T17:30:28.000000Z"} 2026-10-10T17:30:28+00:00