Go/code.vikunja.io/api CVE-2026-54766: medium 5.3, EPSS 0.43%

Vikunja has a project duplication bypasses write-permission check on the target parent project

Action: Upgrade code.vikunja.io/api to 2.4.0 or later.

go get code.vikunja.io/api@v2.4.0

Affected

Fixed versions

Sources

• osv: GHSA-f27p-pw2p-9pr4
• nvd: CVE-2026-54766
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-f27p-pw2p-9pr4
• https://github.com/go-vikunja/vikunja/pull/3239
• https://github.com/go-vikunja/vikunja/commit/d911caaa11c748c3abc6b98b3189afea2677bcb0
• https://github.com/go-vikunja/vikunja
• https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0

CVE-2026-54766 · published 2026-08-28T16:37:26Z · modified 2026-09-02T19:55:46.453854844Z · JSON