felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/vikunja.md

vikunja — triage (pin vikunja/vikunja:2.6.0, SQLite, single image)

Template: setup_gate: true, signup_block on /api/v1/register, registration switched off after setup. No OIDC, no Todoist/Trello/MS-To-Do migrator env (all off by default). Public behind Vikunja's own login.

Notices (43 GHSA + 2 release hits)

The 6 published 2026-10-03 with "no fixed version named yet" — GHSA-m687-p538-r5hp (high), -4hv6-xc92-j86g, -hjx8-qv73-f7cm, -pjr3-86v4-5p7w, -fmmf-xq98-g327, -fprf-r6rv-xg99 — have ranges ending <= 2.6.0 and are exactly the "six security fixes" of v2.7.0: the vikunja.io 2.7.0 changelog page links all six GHSA ids. FIXED in 2.7.0. REAL for our 2.6.0. The 37 published 2026-10-22: range <= 2.7.0, patched 2.7.1 (2.7.1 changelog page links 41 GHSA ids).

NOT-A-FINDING (3):

• GHSA-h8wj-3gwg-jjjg (low): release toolchain (xgo) pulled by mutable ref — project CI, not the product.
• GHSA-wqjr-22r7-5437 (medium): Trello/Todoist/MS To Do migrations — those migrators need OAuth env, off in our template.
• GHSA-xgw3-ccqg-f6ww (low): migration OAuth callbacks — same migrators, off.

REAL (40 GHSA + release:v2.7.0 + release:v2.7.1 = 42 / 45). Worst: high — GHSA-m687 (any localhost page can take the session: no attacker login, needs victim's browser), GHSA-hq66 (account deletion escalates read-only shares; any user), GHSA-5q33 (webhook payloads bypass read auth; any user). Most others need any logged-in user. Low/no reach on a box: GHSA-9rfw/rp64/hrw2 (file permissions/paths inside the container; we do not run vikunja dump), GHSA-frf4 (login CSRF, no OIDC here but form-login part applies).

Fix

Smallest fixing all: 2.7.1. TARGET vikunja/vikunja:2.7.1 (newest stable; Hub tags 2.7.1, 2.7, 2, latest). Same main (2): yes. Breaking/migrations 2.6.0 -> 2.7.1 (read v2.7.0, v2.7.1 GitHub bodies + both vikunja.io changelog pages):

• 2.7.1 "Things to check": API token permission keys renamed (existing tokens auto-migrated); access log writes route template; new limits 100 manual / 50 filter buckets per view, migration.maxitems 100000; v2 attachment download ignores preview_size.
• 2.7.1: stored files + SQLite no longer world-readable (permission tightening — check the backup path reads them as root; unsure).
• 2.7.0: link-share management now needs project admin; frontend dropped v1 API client. No env rename, no file layout change. None is a data/file conversion or removed config. Lane: SECURITY_FIX. Classifier note: "no fixed version named yet" was wrong for 6 notices — a range with an upper bound <= 2.6.0 published after v2.7.0 means "fixed in the next release"; the classifier should read the range upper bound (and the release body links) before saying no fix.