go-vikunja — Vulnerabilities & Security Advisories 35

Vikunja is an open-source, self-hosted task management application designed for personal and team productivity, written in Go with a Vue.js frontend. Security audits have identified thirty-five Common Vulnerabilities and Exposures (CVEs) associated with the platform, primarily stemming from its web interface and API endpoints. Historically, these flaws frequently involve Cross-Site Scripting (XSS), SQL injection, and improper access control mechanisms that allow privilege escalation. Several incidents highlight risks related to unauthenticated remote code execution and insecure direct object references, which can expose sensitive user data or allow attackers to manipulate task records. The project’s architecture, while modern, has demonstrated vulnerabilities in input validation and session management. These recurring issues underscore the importance of rigorous code review and timely patching for administrators deploying Vikunja in production environments, as the cumulative risk profile suggests potential for significant data breaches if left unaddressed.