CVE-2026-33679— Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections
Quick assessment
Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.2.1之前版本存在代码问题漏洞，该漏洞源于DownloadImage函数缺少SSRF保护，可能导致服务端请求伪造攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33679
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http.Client{}` with no SSRF protection when downloading user avatar images from the OpenID Connect `picture` claim URL. An attacker who controls their OIDC profile picture URL can force the Vikunja server to make HTTP GET requests to arbitrary internal or cloud metadata endpoints. This bypasses the SSRF protections that are correctly applied to the webhook system. Version 2.2.1 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Vikunja 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.2.1之前版本存在代码问题漏洞，该漏洞源于DownloadImage函数缺少SSRF保护，可能导致服务端请求伪造攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| go-vikunja | vikunja | < 2.2.1 | - |
|
II. Public POCs for CVE-2026-33679
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33679
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-33679 (1)
Vendor Advisories for CVE-2026-33679 (1)
Vendor Pages for CVE-2026-33679 (1)
Same Patch Batch · go-vikunja · 2026-03-24 · 16 CVEs total
| CVE-2026-33316 | 8.1 HIGH | Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablem |
| CVE-2026-33678 | 8.1 HIGH | Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion |
| CVE-2026-33680 | 7.5 HIGH | Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission E |
| CVE-2026-33474 | 6.5 MEDIUM | Vikunja Affected by DoS via Image Preview Generation |
| CVE-2026-33677 | 6.5 MEDIUM | Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API |
| CVE-2026-33676 | 6.5 MEDIUM | Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorizatio |
| CVE-2026-33675 | 6.4 MEDIUM | Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Int |
| CVE-2026-33473 | 5.7 MEDIUM | Vikunja has TOTP Reuse During Validity Window |
| CVE-2026-33315 | Vikunja has a 2FA Bypass via Caldav Basic Auth | |
| CVE-2026-33313 | Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments | |
| CVE-2026-33335 | Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openEx | |
| CVE-2026-33334 | Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegratio | |
| CVE-2026-33336 | Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation | |
| CVE-2026-33668 | Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and O | |
| CVE-2026-33700 | Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Projec |
IV. Related Vulnerabilities
Same product: vikunja
-
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API
Same vendor: go-vikunja
-
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API
Same weakness: CWE-918
-
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_red -
CVE-2026-105628
Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exf -
CVE-2026-104977
Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachab -
CVE-2026-104976
Plane: SSRF in Gitea OAuth -
CVE-2026-104973
Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in We
V. Comments for CVE-2026-33679
No comments yet