Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Fix availableCritical · CVSS 9.3EPSS 0.27%

Published Oct 9, 2026 · updated Oct 9, 2026

What to do

  1. Upgrade to a fixed version: code.vikunja.io/api 2.4.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gocode.vikunja.io/api

Vulnerable versions
>= 0.24.0, <= 2.3.0
Fixed in
2.4.0

Check your project: go list -m all | grep code.vikunja.io/api

Sources

CWE-639 Authorization Bypass Through User-Controlled Key · CWE-863 Incorrect Authorization

← All critical vulnerabilities