Vulnerability record · CVE-2026-33679 · published 24 March 2026

CVE-2026-33679: Vikunja server-side request forgery (ssrf) vulnerability

Vikunja · Vikunja

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http.Client{}` with no SSRF protection when downloading user avatar images from the OpenID Connect `picture` claim URL. An attacker who controls their OIDC profile picture URL can force the Vikunja server to make HTTP GET requests to arbitrary internal or cloud metadata endpoints. This bypasses the SSRF protections that are correctly applied to the webhook system. Version 2.2.1 patches the issue.

7.4 CVSS 3.1 High EPSS 0.45% · top 63.3% CWE-918 · Server-side request forgery (SSRF)

7.4CVSS 3.1 base score

0.45%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Vikunja Vikunja

References

Link	Tags
https://github.com/go-vikunja/vikunja/commit/363aa6642352b08fc8bc6aaff2f3a550393af1cf	Patch
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g9xj-752q-xh63	ExploitVendor Advisory
https://vikunja.io/changelog/vikunja-v2.2.2-was-released	Release Notes

Track CVE-2026-33679 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-28268Vikunja weak password recovery vulnerabilityVikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password re…EPSS 0.89%27 Feb 2026 9.1CVE-2026-34727Vikunja improper authentication vulnerabilityVikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking wh…EPSS 0.42%10 Apr 2026 9.1CVE-2026-27575Vikunja weak password requirements vulnerabilityVikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 123…EPSS 0.45%25 Feb 2026 8.6CVE-2026-25935Vikunja cross-site scripting vulnerabilityVikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the descriptio…EPSS 0.33%11 Feb 2026 8.3CVE-2026-35595Vikunja improper privilege management vulnerabilityVikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only…EPSS 0.46%10 Apr 2026 8.1CVE-2026-33678Vikunja insecure direct object reference vulnerabilityVikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`W…EPSS 0.38%24 Mar 2026 8.1CVE-2026-33316Vikunja improper access control vulnerabilityVikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled user…EPSS 0.44%24 Mar 2026 7.5CVE-2026-35597Vikunja improper restriction of authentication attempts vulnerabilityVikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a …EPSS 0.47%10 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2026-33679), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.