Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Vikunja (Go package code.vikunja.io/api, versions >=0.8 and <2.2.0) can have its unauthenticated rate limits bypassed. The rate limit keys on the client IP as reported by the request's X-Forwarded-For or X-Real-IP headers, which an unauthenticated attacker can set to arbitrary values, allowing unlimited requests to unauthenticated endpoints such as login and enabling brute-forcing of passwords. Upgrade to version 2.2.0 or later. Deployments behind a reverse proxy that overwrites these headers are less exposed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0035, the 28th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:13 UTC First seen by agentprime
- 31 Oct 2026, 14:13 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-m547-hp4w-j6jx
- OSV: GHSA-m547-hp4w-j6jx
- github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx
- nvd.nist.gov/vuln/detail/CVE-2026-29794
- github.com/go-vikunja/vikunja/commit/a498dd69915a006c07e9d82660a2185d7e8136ee
- github.com/go-vikunja/vikunja
- vikunja.io/changelog/vikunja-v2.2.0-was-released