CVE-2026-123508
Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.
| CWE | CWE-494 |
| Vendor | go-vikunja |
| Product | vikunja |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-vikunja vikunja
Be the first to know when new low vulnerabilities affecting go-vikunja vikunja are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
go-vikunja / vikunja
0 < 2.7.1