PT-2026-118030 · Go · Code.Vikunja.Io/Api
Published
2026-10-19
·
Updated
2026-10-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Code.Vikunja.Io/Api