DEV Community: CVE Reports

CVE-2026-87697: CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling

CVE Reports — Wed, 14 Oct 2026 00:31:28 +0000

CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling

Vulnerability ID: CVE-2026-87697
CVSS Score: 8.8
Published: 2026-10-13

A remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations.

TL;DR

Implicit type auto-conversion in WPF PresentationCore clipboard routines allowed untrusted data streams to be automatically deserialized, enabling arbitrary code execution upon accessing clipboard data.

Technical Details

CWE ID: CWE-502
Attack Vector: Network (AV:N)
Attack Complexity: Low (AC:L)
Privileges Required: None (PR:N)
User Interaction: Required (UI:R)
CVSS v3.1 Score: 8.8 (HIGH)
Exploit Status: None / Unproven
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 8.0
Microsoft .NET 9.0
Microsoft .NET 10.0
Microsoft .NET 11.0
Microsoft Visual Studio 2022 (v17.14)
Microsoft Visual Studio 2026 (v18.10)
.NET 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
.NET 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
.NET 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
.NET 11.0: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2)
Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)
Visual Studio 2026: >= 18.10.0, < 18.10.4 (Fixed in: 18.10.4)

Code Analysis

Commit: 0987b40

Fix clipboard auto-convert parameters to enforce autoConvert: false during typed data checks.

Commit: 8dd1964

Servicing update patch for PresentationCore clipboard validation.

Mitigation Strategies

Upgrade .NET SDK and runtime components to fixed servicing releases.
Explicitly set autoConvert: false when querying external IDataObject contents in WPF application code.
Restrict user execution privileges for applications interacting with untrusted clipboard inputs.

Remediation Steps:

Identify all installed instances of .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio build hosts.
Apply security update builds: .NET 8.0.32, .NET 9.0.21, .NET 10.0.13, or .NET 11.0.0-rc.2.
Update Visual Studio 2022 installations to 17.14.42 and Visual Studio 2026 to 18.10.4.
Recompile WPF applications against the updated target SDKs.

References

Read the full report for CVE-2026-87697 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-70007: CVE-2026-70007: Out-of-Bounds Write Vulnerability in .NET Framework and WPF Subsystem

CVE Reports — Tue, 13 Oct 2026 23:31:59 +0000

CVE-2026-70007: Out-of-Bounds Write Vulnerability in .NET Framework and WPF Subsystem

Vulnerability ID: CVE-2026-70007
CVSS Score: 8.8
Published: 2026-10-13

An out-of-bounds write vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio allows unauthenticated remote attackers to execute arbitrary code via crafted pixel-shader bytecode or auto-converted clipboard payloads.

TL;DR

A heap-based out-of-bounds write vulnerability (CWE-787) in the Windows Presentation Foundation (WPF) graphics subsystem (CPSTrans::Initialize) and Clipboard API routines allows remote code execution when a targeted application processes malicious graphics assets or clipboard data.

Technical Details

CWE ID: CWE-787 (Out-of-bounds Write)
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 8.8 (High)
EPSS Score: Pending Baseline
Impact: Remote Code Execution (C:H/I:H/A:H)
Exploit Status: Unweaponized / No Public PoC
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 8.0
Microsoft .NET 9.0
Microsoft .NET 10.0
Microsoft .NET 11.0
Microsoft .NET Framework 3.5
Microsoft .NET Framework 4.6.2 / 4.7 / 4.7.1 / 4.7.2
Microsoft .NET Framework 4.8
Microsoft .NET Framework 4.8.1
Microsoft Visual Studio 2022
Microsoft Visual Studio 2026
.NET 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
.NET 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
.NET 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
.NET 11.0: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2)
.NET Framework 4.8.1: < 4.8.9363.0 (Fixed in: 4.8.9363.0)
Visual Studio 2022: < 17.14.42 (Fixed in: 17.14.42)

Code Analysis

Commit: 0987b40

Fix Clipboard API auto-conversion issue in GetTypedDataIfAvailable

Commit: 8319b24

Add TrueType Subsetting Table Length Safeguards in TtfDelta/modtable.cpp

Mitigation Strategies

Apply official Microsoft security updates for affected .NET, .NET Framework, and Visual Studio products.
Enforce least-privilege user execution policies to limit the potential impact of code execution.
Monitor process trees for anomalous child process spawning from WPF hosting binaries like PresentationHost.exe.

Remediation Steps:

Identify all systems running vulnerable versions of .NET runtime (8.0, 9.0, 10.0, 11.0), .NET Framework, or Visual Studio.
Deploy Microsoft Security Updates released on October 13, 2026 via Windows Update, WSUS, or enterprise deployment tools.
Verify that .NET 8.0 is updated to >= 8.0.32, .NET 9.0 to >= 9.0.21, .NET 10.0 to >= 10.0.13, and .NET 11.0 to >= 11.0.0-rc.2.
Ensure Visual Studio 2022 is updated to version 17.14.42 or higher.

References

Read the full report for CVE-2026-70007 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-70186: CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock

CVE Reports — Tue, 13 Oct 2026 22:31:28 +0000

CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock

Vulnerability ID: CVE-2026-70186
CVSS Score: 7.5
Published: 2026-10-13

ASP.NET Core contains a thread deadlock vulnerability (CWE-833) that allows an unauthenticated remote attacker to cause a denial of service over the network by exhausting server thread pool resources.

TL;DR

Unauthenticated remote requests can trigger inconsistent synchronization lock orders in ASP.NET Core execution paths, leading to permanent thread deadlocks and host application unresponsiveness.

Technical Details

CWE ID: CWE-833 (Deadlock)
CVSS v3.1 Score: 7.5 (High)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector: Network (Unauthenticated)
Exploit Status: Unproven / No Public Functional Exploit
CISA KEV Status: Not Listed
Impact Category: Denial of Service (Thread Starvation)

Affected Systems

ASP.NET Core 8.0 (versions < 8.0.32)
ASP.NET Core 9.0 (versions < 9.0.21)
ASP.NET Core 10.0 (versions < 10.0.13)
Microsoft Visual Studio 2022 v17.14 (versions < 17.14.42)
Microsoft Visual Studio 2026 v18.10 (versions < 18.10.4)
ASP.NET Core 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
ASP.NET Core 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
ASP.NET Core 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
Microsoft Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)
Microsoft Visual Studio 2026: >= 18.10.0, < 18.10.4 (Fixed in: 18.10.4)

Mitigation Strategies

Upgrade ASP.NET Core runtime and SDK packages to versions 8.0.32, 9.0.21, or 10.0.13.
Update Microsoft Visual Studio 2022 to build 17.14.42 or Visual Studio 2026 to build 18.10.4.
Implement client connection limits and request timeout constraints at reverse proxy layer.

Remediation Steps:

Identify all deployed applications compiled against or running on vulnerable ASP.NET Core versions.
Apply official Microsoft security updates to host environments, container baselines, and developer workstations.
Monitor thread pool performance metrics (e.g., ThreadPool.ThreadCount) using .NET EventCounters or OpenTelemetry to verify system stability post-patching.

References

Read the full report for CVE-2026-70186 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-70035: CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime

CVE Reports — Tue, 13 Oct 2026 21:31:01 +0000

CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime

Vulnerability ID: CVE-2026-70035
CVSS Score: 8.8
Published: 2026-10-13

CVE-2026-70035 is a high-severity Remote Code Execution (RCE) vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio caused by improper handling during the deserialization of untrusted data (CWE-502). An unauthenticated attacker can execute arbitrary code within the context of the affected process by delivering a crafted serialized payload.

TL;DR

An insecure deserialization vulnerability in .NET allows unauthenticated attackers to execute arbitrary code via crafted object graphs requiring user interaction.

Technical Details

CWE ID: CWE-502 (Deserialization of Untrusted Data)
CVSSv3.1 Score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Exploit Status: Unproven / None
CISA KEV Status: Not Listed

Affected Systems

Microsoft .NET 8.0
Microsoft .NET 9.0
Microsoft .NET 10.0
Microsoft .NET 11.0
Microsoft .NET Framework 3.5
Microsoft .NET Framework 4.6.2
Microsoft .NET Framework 4.7
Microsoft .NET Framework 4.7.1
Microsoft .NET Framework 4.7.2
Microsoft .NET Framework 4.8
Microsoft .NET Framework 4.8.1
Microsoft Visual Studio 2022 version 17.14
Microsoft Visual Studio 2026 version 18.10
.NET: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
.NET: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
.NET: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
.NET Framework: < 4.8.9363.0 (Fixed in: 4.8.9363.0)
Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)

Mitigation Strategies

Apply official vendor security updates for .NET runtime, .NET Framework, and Visual Studio.
Replace legacy binary and polymorphic serializers with modern non-polymorphic formats such as System.Text.Json.
Implement strict custom SerializationBinder type whitelisting for applications that must deserialize binary data.

Remediation Steps:

Identify all installed instances of .NET runtimes (8.0, 9.0, 10.0, 11.0) and .NET Framework.
Upgrade .NET 8.0 installations to version 8.0.32 or higher.
Upgrade .NET 9.0 installations to version 9.0.21 or higher.
Upgrade .NET 10.0 installations to version 10.0.13 or higher.
Apply October 2026 Microsoft Security Updates for .NET Framework via Windows Update.
Upgrade Visual Studio 2022 to version 17.14.42 and Visual Studio 2026 to 18.10.4.

References

Read the full report for CVE-2026-70035 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-70183: CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition

CVE Reports — Tue, 13 Oct 2026 20:31:27 +0000

CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition

Vulnerability ID: CVE-2026-70183
CVSS Score: 7.5
Published: 2026-10-13

An elevation of privilege vulnerability exists in ASP.NET Core and Microsoft Visual Studio due to improper synchronization during concurrent thread execution. Authenticated remote attackers with low privileges can exploit a timing window to manipulate shared resources and assume higher-level execution contexts.

TL;DR

A race condition in ASP.NET Core allows authenticated low-privilege remote users to elevate privileges by sending high-frequency concurrent requests that hit unsynchronized shared memory structures.

Technical Details

CWE ID: CWE-362 (Race Condition)
Attack Vector: Network (AV:N)
Attack Complexity: High (AC:H)
Privileges Required: Low (PR:L)
CVSS v3.1 Score: 7.5 (High)
CISA KEV Status: Not Listed
Exploit Status: Unproven / No Public PoC
Impact: Elevation of Privilege (High C/I/A)

Affected Systems

ASP.NET Core 8.0 (< 8.0.32)
ASP.NET Core 9.0 (< 9.0.21)
ASP.NET Core 10.0 (< 10.0.13)
ASP.NET Core 11.0 (< 11.0.0-rc.2)
Microsoft Visual Studio 2022 v17.14 (< 17.14.42)
Microsoft Visual Studio 2026 v18.10 (< 18.10.4)
ASP.NET Core 8.0: < 8.0.32 (Fixed in: 8.0.32)
ASP.NET Core 9.0: < 9.0.21 (Fixed in: 9.0.21)
ASP.NET Core 10.0: < 10.0.13 (Fixed in: 10.0.13)
ASP.NET Core 11.0: < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2)
Microsoft Visual Studio 2022 (v17.14): 17.14.0 - < 17.14.42 (Fixed in: 17.14.42)
Microsoft Visual Studio 2026 (v18.10): 18.10.0 - < 18.10.4 (Fixed in: 18.10.4)

Mitigation Strategies

Apply vendor security patches for ASP.NET Core and Microsoft Visual Studio immediately.
Implement rate limiting and concurrency throttling on sensitive stateful API endpoints.
Enforce CI/CD package dependency scanning using dotnet list package --vulnerable.

Remediation Steps:

Identify all deployed ASP.NET Core runtime instances and Visual Studio development systems.
Upgrade ASP.NET Core packages to fixed versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.
Update Visual Studio 2022 to 17.14.42 or higher, and Visual Studio 2026 to 18.10.4 or higher.
Recompile and redeploy affected ASP.NET Core applications across staging and production environments.

References

Read the full report for CVE-2026-70183 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-107844: CVE-2026-107844: Path Traversal Vulnerability in Contao ImagesController

CVE Reports — Sat, 10 Oct 2026 22:30:30 +0000

CVE-2026-107844: Path Traversal Vulnerability in Contao ImagesController

Vulnerability ID: CVE-2026-107844
CVSS Score: 5.3
Published: 2026-10-09

A path traversal vulnerability (CWE-22) in Contao CMS allows unauthenticated remote attackers to bypass directory boundary restrictions in ImagesController and access files within the project directory.

TL;DR

Unauthenticated path traversal in Contao ImagesController permits arbitrary reading of localized files matching allowed extensions and system directory probing.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
CVSS v3.1 Score: 5.3 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector: Network (Unauthenticated HTTP/HTTPS GET requests)
EPSS Score: 0.00312 (22.18th percentile)
Impact: Partial Information Disclosure / Local File Enumeration
Exploit Status: Proof of Concept / Public Commit Diffs Available
CISA KEV Status: Not Listed

Affected Systems

Contao CMS 5.0.0 through 5.3.49
Contao CMS 5.4.0-RC1 through 5.7.11
Contao CMS: >= 5.0.0, < 5.3.50 (Fixed in: 5.3.50)
Contao CMS: >= 5.4.0-RC1, < 5.7.12 (Fixed in: 5.7.12)

Code Analysis

Commit: 867c055

Fix path traversal vulnerability in ImagesController by checking Path::isBasePath()

Exploit Details

GitHub Security Advisory: Advisory details and test suite PoC demonstrating path traversal via ImagesController.

Mitigation Strategies

Upgrade Contao CMS dependencies to fixed maintenance releases 5.3.50 or 5.7.12.
Enforce Web Application Firewall (WAF) filtering on HTTP request URI parameters for path traversal sequences.
Restrict 'contao.image.valid_extensions' configuration to essential image asset types only.
Disable application debug mode in production deployment environments to avoid absolute path disclosure.

Remediation Steps:

Run 'composer update contao/contao --with-dependencies' in project root environments.
Verify that contao package versions resolved match >= 5.3.50 or >= 5.7.12.
Clear Symfony application caches using 'php vendor/bin/contao-console cache:clear'.
Execute automated or unit tests against ImagesController routes to confirm traversal attempts return HTTP 404.

References

Read the full report for CVE-2026-107844 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-107848: CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests

CVE Reports — Sat, 10 Oct 2026 20:30:29 +0000

CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests

Vulnerability ID: CVE-2026-107848
CVSS Score: 3.5
Published: 2026-10-09

Contao Open Source CMS versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 contain a Cross-Site Request Forgery (CSRF) vulnerability in backend parameter handling. The RequestTokenListener component validates anti-CSRF tokens solely for HTTP POST requests, while GET-based declarative guards run only when an act parameter is present in the query string. Consequently, custom backend actions dispatched via alternative parameters such as key= can execute without CSRF token verification when triggered by an authenticated user.

TL;DR

Contao CMS fails to validate anti-CSRF tokens for custom backend GET actions using query parameters like key=. An attacker can trick an authenticated backend user into visiting a crafted URL to execute unauthorized state-changing operations within the user's permission scope.

Technical Details

CWE ID: CWE-352 (Cross-Site Request Forgery)
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 3.5 (Low)
EPSS Score: 0.00113 (1.34th percentile)
Impact: Low Integrity Impact (State-changing backend operations)
Exploit Status: None / No public functional exploit
CISA KEV Status: Not listed

Affected Systems

Contao Open Source CMS (contao/contao) >= 4.0.0, < 5.3.50
Contao Open Source CMS (contao/contao) >= 5.4.0-RC1, < 5.7.12
contao/contao: >= 4.0.0, < 5.3.50 (Fixed in: 5.3.50)
contao/contao: >= 5.4.0-RC1, < 5.7.12 (Fixed in: 5.7.12)

Code Analysis

Commit: 34dd27e

Enforce POST method and explicit CSRF token checks for custom key backend operations

Mitigation Strategies

Upgrade Contao CMS to version 5.3.50, 5.7.12, or higher.
Enforce HTTP POST method on all custom state-changing DCA actions (key=).
Implement explicit ContaoCsrfTokenManager::isTokenValid() verification in custom controller handlers.
Configure backend session cookies with SameSite=Strict or SameSite=Lax attributes.

Remediation Steps:

Run php composer.phar update contao/contao to pull the latest security fixes.
Audit custom third-party extensions for GET-based backend actions using key= query parameters.
Update custom DCA definitions to require 'method' => 'POST' for state-changing operations.
Clear application cache and verify backend operation behavior.

References

Read the full report for CVE-2026-107848 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-107843: CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS

CVE Reports — Sat, 10 Oct 2026 19:31:00 +0000

CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS

Vulnerability ID: CVE-2026-107843
CVSS Score: 5.3
Published: 2026-10-09

Contao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.

TL;DR

Unauthenticated attackers can send repeated HTTP POST requests to Contao registration pages to trigger activation emails without captcha verification or rate limiting, causing mail flooding and unconfirmed account enumeration.

Technical Details

CWE ID: CWE-770, CWE-204
Attack Vector: Network (Unauthenticated HTTP POST)
CVSS v3.1: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
EPSS Score: 0.00255 (15.79th percentile)
Impact: Email Flooding / Account State Enumeration
Exploit Status: Unproven / No Public Exploit
CISA KEV Status: Not Listed

Affected Systems

Contao Open Source CMS versions 4.1.0 through 5.3.49
Contao Open Source CMS versions 5.4.0-RC1 through 5.7.11
Contao Open Source CMS: >= 4.1.0, < 5.3.50 (Fixed in: 5.3.50)
Contao Open Source CMS: >= 5.4.0-RC1, < 5.7.12 (Fixed in: 5.7.12)

Code Analysis

Commit: 2ea6117

Fix form submit validation and enforce rate limit on activation email resends

Mitigation Strategies

Upgrade Contao CMS to version 5.3.50 or 5.7.12.
Implement WAF rules to rate-limit POST requests to registration endpoints.
Monitor application logs for high volumes of POST requests carrying the email parameter.

Remediation Steps:

Check current Contao version via composer.lock or management console.
Execute composer update contao/config-bundle contao/core-bundle to pull version 5.3.50 or 5.7.12.
Clear application cache using vendor/bin/contao-console cache:clear.
Verify that repeated POST requests to registration forms trigger rate limit notices.

References

Read the full report for CVE-2026-107843 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-107842: CVE-2026-107842: Information Disclosure via Stale Indexing in Contao Search Module

CVE Reports — Sat, 10 Oct 2026 18:31:01 +0000

CVE-2026-107842: Information Disclosure via Stale Indexing in Contao Search Module

Vulnerability ID: CVE-2026-107842
CVSS Score: 5.3
Published: 2026-10-09

An information disclosure vulnerability in Contao CMS allows unauthenticated site visitors to view protected page titles, URLs, and text excerpts through search queries when protected page indexing is disabled after previously being enabled.

TL;DR

Contao's ModuleSearch failed to filter out stale protected page index entries from database table tl_search when contao.search.index_protected configuration was set to false, resulting in sensitive content disclosure in search results.

Technical Details

CWE ID: CWE-200
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 5.3 (Medium)
EPSS Score: 0.00262 (16.62th percentile)
Impact: Partial Information Disclosure
Exploit Status: Unproven / No Public Exploits
CISA KEV Status: Not Listed

Affected Systems

Contao CMS 4.0.0 before 5.3.50
Contao CMS 5.4.0-RC1 before 5.7.12
contao/contao: >= 4.0.0, < 5.3.50 (Fixed in: 5.3.50)
contao/contao: >= 5.4.0-RC1, < 5.7.12 (Fixed in: 5.7.12)

Code Analysis

Commit: 572686a

Fix filtering of protected search results when index_protected is false

Mitigation Strategies

Upgrade contao/contao package to patched version 5.3.50 or 5.7.12.
Rebuild and purge the search index via the Contao Maintenance backend panel if index_protected configuration was modified.

Remediation Steps:

Run 'composer update contao/contao --with-dependencies' in project root.
Log in to Contao Backend and open the Maintenance module.
Purge the Search Index database table tl_search.
Rebuild search index to ensure only current public pages are indexed.

References

Read the full report for CVE-2026-107842 on our website for more details including interactive diagrams and full exploit analysis.

GHSA-G38J-7V97-X298: GHSA-G38J-7V97-X298: Missing Authorization Check in Vikunja CalDAV Task Relation Creation

CVE Reports — Sat, 10 Oct 2026 17:30:30 +0000

GHSA-G38J-7V97-X298: Missing Authorization Check in Vikunja CalDAV Task Relation Creation

Vulnerability ID: GHSA-G38J-7V97-X298
CVSS Score: 6.5
Published: 2026-10-09

In Vikunja prior to version 2.6.0, relation creation via the CalDAV endpoint fails to invoke the TaskRelation.CanCreate authorization check. This missing access control allows an authenticated user to establish unauthorized relationships and perform write operations against any task, provided its unique identifier (UID) is known.

TL;DR

Vikunja's CalDAV engine omitted authorization checks when creating task relations, allowing authenticated users with a target task UID to create unauthorized linkages and modify restricted task structures.

Technical Details

CWE Identifier: CWE-862 (Missing Authorization)
Attack Vector: Network (CalDAV Endpoint)
CVSS Score: 6.5 (Medium)
EPSS Score: N/A (GHSA identifier without CVE mapping)
Impact: Unauthorized Write / Relation Creation across tasks
Exploit Status: No public weaponized exploit available
CISA KEV Status: Not Listed

Affected Systems

Vikunja backend installations prior to version 2.6.0 running CalDAV services
Vikunja: < 2.6.0 (Fixed in: 2.6.0)

Code Analysis

Commit: 077dc4d

Enforce TaskRelation authorization checks during CalDAV relation handling

Mitigation Strategies

Upgrade the Vikunja backend deployment to version v2.6.0 or higher.
Restrict network access to the CalDAV endpoint (/dav/...) via web application firewall or reverse proxy if patching cannot be immediately performed.
Audit database task relations for unexpected cross-user or cross-project links established prior to patching.

Remediation Steps:

Pull the latest Vikunja container image or binary release tagged v2.6.0 or later.
Restart the Vikunja backend service to load the updated executable binaries.
Inspect server logs for CalDAV request activity to ensure operational stability after patching.

References

Read the full report for GHSA-G38J-7V97-X298 on our website for more details including interactive diagrams and full exploit analysis.

GHSA-3HC7-R24J-RPWC: GHSA-3hc7-r24j-rpwc: Cross-Project Task Disclosure via Subtask Expansion in Vikunja

CVE Reports — Sat, 10 Oct 2026 16:31:08 +0000

GHSA-3hc7-r24j-rpwc: Cross-Project Task Disclosure via Subtask Expansion in Vikunja

Vulnerability ID: GHSA-3HC7-R24J-RPWC
CVSS Score: 6.8
Published: 2026-10-09

A cross-project information disclosure vulnerability in Vikunja allows authenticated users with read access to one project to view private task details from unauthorized projects via subtask expansion parameters.

TL;DR

Vikunja API endpoints prior to version 2.6.0 fail to apply project-level authorization filters when recursively expanding subtasks, exposing private task metadata across unauthorized project boundaries.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-200 / CWE-285 / CWE-862
Attack Vector: Network (Remote REST API)
CVSS v4 Score: 6.8 (Medium)
Privileges Required: Low (Authenticated user with access to at least one project)
User Interaction: None
Exploit Status: Proof of Concept Available
CISA KEV Status: Not Listed

Affected Systems

Vikunja API prior to version 2.6.0 (code.vikunja.io/api)
Vikunja API: < 2.6.0 (Fixed in: 2.6.0)

Code Analysis

Commit: 077dc4d

fix(security): harden authorization and resource limits

Exploit Details

Vendor Advisory (GHSA-3hc7-r24j-rpwc): Proof of concept HTTP requests demonstrating parameter expansion exploitation.

Mitigation Strategies

Upgrade Vikunja API component to version 2.6.0 or higher.
Filter request parameters matching expand[]=subtasks at the reverse proxy or WAF layer if immediate patching is delayed.
Audit existing cross-project subtask relationships across sensitive projects.

Remediation Steps:

Identify installed Vikunja API version using GET /api/v1/info.
Update deployment manifests to target tag v2.6.0 or rebuild from commit 077dc4de79ce6f1ab59215a2c7bf9b30423685f2.
Restart the API service and verify subtask expansion requests against restricted projects return 403 or strip unauthorized objects.

References

Read the full report for GHSA-3HC7-R24J-RPWC on our website for more details including interactive diagrams and full exploit analysis.

GHSA-8WVG-R2J4-3737: GHSA-8wvg-r2j4-3737: Email Address Exposure in Vikunja Task Assignees API

CVE Reports — Sat, 10 Oct 2026 15:30:30 +0000

GHSA-8wvg-r2j4-3737: Email Address Exposure in Vikunja Task Assignees API

Vulnerability ID: GHSA-8WVG-R2J4-3737
CVSS Score: 4.3
Published: 2026-10-09

An information disclosure vulnerability in Vikunja allows authenticated users with read access to a task to expose private email addresses of assigned users through the API task assignees endpoint due to an unmasked database query.

TL;DR

Vikunja versions prior to 2.6.0 disclose private user email addresses to any authenticated user with read permissions on a task due to over-broad SQL model population in the task assignees endpoint.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-200
CVSSv3 Score: 4.3 (Medium)
Attack Vector: Network (Authenticated)
Impact: Information Disclosure (PII / Private Email)
Exploit Status: Proof-of-Concept
Patched Version: v2.6.0

Affected Systems

code.vikunja.io/api < 2.6.0
github.com/go-vikunja/vikunja < v2.6.0
Vikunja: < 2.6.0 (Fixed in: v2.6.0)

Code Analysis

Commit: 0855e13

fix(tasks): hide assignee email addresses

Mitigation Strategies

Upgrade Vikunja instance to v2.6.0 or higher
Restrict project sharing permissions with external untrusted accounts
Deploy WAF rules to sanitize email fields in response objects

Remediation Steps:

Fetch release tag v2.6.0 or later from official repository sources
Rebuild or update the container image / application binary
Restart the Vikunja service and verify application version via API health check

References

Read the full report for GHSA-8WVG-R2J4-3737 on our website for more details including interactive diagrams and full exploit analysis.