Everything Threat Times has reported about Vikunja: 3 stories, newest first. Part of our Vulnerabilities coverage.
Version 2.4.0 of the self-hosted task manager Vikunja resolves a high-severity flaw where plaintext tokens allowed full account takeover if database access was compromised.
A flaw in the self-hosted task manager allowed limited API tokens to escalate privileges by minting unrestricted session credentials.
A critical flaw in Vikunja allowed attackers to view private kanban boards via share links, exposing user data until version 2.4.0.