Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api

GHSA-g38j-7v97-x298 · GO-2026-6732 · 19/10/2026 公開 · 19/10/2026 更新

要点

パッケージ	影響を受けるバージョン	修正済みバージョン
code.vikunja.io/api Go	`全バージョン`	修正版なし

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

全バージョン

修正版なし

概要

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.

code.vikunja.io/api のその他の脆弱性

すべて見る →