{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"code.vikunja.io/api","cve_ids":["CVE-2026-111922"],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m687-p538-r5hp","id":"tcs_01M5JJNA0G04VRS1H1GGV5NJJK","modified_at":"2026-10-19T21:40:54.835844206Z","published_at":"2026-10-19T21:08:26Z","references":["https://osv.dev/vulnerability/GO-2026-6739","https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GO-2026-6739","url":"https://osv.dev/vulnerability/GO-2026-6739"},{"source":"nvd","source_id":"CVE-2026-111922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111922"}],"summary":"Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api"}