Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-111922

Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

go-vikunja vikunja

Default version status: unaffected

  • 2.2.0 to < 2.7.0affected
  • 2.7.0unaffected
pkg:golang/code.vikunja.io/api

References