« Volver al listado

CVE-2026-29794

Estado: AnalizadaMedia (5.3)—

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to the rate-limit relying on the value of `(echo.Context).RealIP`. Unauthenticated users can abuse endpoints available to them for different potential impacts. The immediate concern would be brute-forcing usernames or specific accounts' passwords. This bypass allows unlimited requests against unauthenticated endpoints. Version 2.2.0 patches the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vikunja — Vikunja

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-29794",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-29794",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-20T17:14:20.354665Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "go-vikunja",
          "product": "vikunja",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.8, < 2.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-20T15:16:16.393",
  "references": [
    {
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://vikunja.io/changelog/vikunja-v2.2.0-was-released",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-807"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to the rate-limit relying on the value of `(echo.Context).RealIP`. Unauthenticated users can abuse endpoints available to them for different potential impacts. The immediate concern would be brute-forcing usernames or specific accounts' passwords. This bypass allows unlimited requests against unauthenticated endpoints. Version 2.2.0 patches the issue."
    },
    {
      "lang": "es",
      "value": "Vikunja es una plataforma de gestión de tareas de código abierto y autoalojada. A partir de la versión 0.8 y antes de la versión 2.2.0, los usuarios no autenticados pueden eludir los límites de tasa incorporados de la aplicación suplantando los encabezados `X-Forwarded-For` o `X-Real-IP` debido a que el límite de tasa se basa en el valor de `(echo.Context).RealIP`. Los usuarios no autenticados pueden abusar de los puntos finales disponibles para ellos para diferentes impactos potenciales. La preocupación inmediata sería el ataque de fuerza bruta de nombres de usuario o contraseñas de cuentas específicas. Esta elusión permite solicitudes ilimitadas contra puntos finales no autenticados. La versión 2.2.0 soluciona el problema."
    }
  ],
  "lastModified": "2026-06-17T10:29:54.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F4BEFD9-23A0-4330-B595-2942F3550AF0",
              "versionEndExcluding": "2.2.0",
              "versionStartIncluding": "0.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}