CVE-2026-111917 | go-vikunja Vikunja up to 2.6.x Session Validation /api/v2/ws handleAuth sid improper authentication

October 17, 2026 Yanac

A vulnerability has been found in go-vikunja Vikunja up to 2.6.x and classified as problematic. This affects the function handleAuth of the file /api/v2/ws of the component Session Validation. This manipulation of the argument sid causes improper authentication.

This vulnerability is tracked as CVE-2026-111917. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More