CVE-2026-29794

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to the rate-limit relying on the value of `(echo.Context).RealIP`. Unauthenticated users can abuse endpoints available to them for different potential impacts. The immediate concern would be brute-forcing usernames or specific accounts' passwords. This bypass allows unlimited requests against unauthenticated endpoints. Version 2.2.0 patches the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-807

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-297957.5stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str CVE-2026-297969.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate d CVE-2026-297977.1No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additiona CVE-2026-29807.2A vulnerability has been found in UTT HiPER 810G up to 1.7.7-1711. Impacted is the function strcpy of the file /goform/setSysAdm. The manipu CVE-2026-29818.8A vulnerability was found in UTT HiPER 810G up to 1.7.7-1711. The affected element is the function strcpy of the file /goform/formTaskEdit_a CVE-2026-298104.3CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.CVE-2026-298117.7CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normal CVE-2026-298124.3CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.CVE-2026-298286.1DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.CVE-2026-29839.8A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the fi CVE-2026-298398.8DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.CVE-2026-29846.5A vulnerability was identified in SourceCodester Student Result Management System 1.0. This affects an unknown function of the file /admin/c