CVE-2026-33335
Vikunja 0.21.0 – 2.2.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-33335 is a medium-severity Improper Authorization in Handler for Custom URL Scheme (CWE-939) vulnerability in Vikunja Vikunja. Its CVSS base score is 6.4 (Medium).
Operationally, ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33335 affects the Vikunja Desktop Electron wrapper, an open-source self-hosted task management platform. The vulnerability exists in versions starting from 0.21.0 and prior to 2.2.0, where URLs from `window.open()` calls are passed directly to `shell.openExternal()` without validation or protocol allowlisting. This flaw, classified under CWE-939 (Improper Authorization in Handler for Custom URL Scheme), has a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
An attacker with low privileges (PR:L), such as an authenticated user able to inject content into Vikunja, can exploit this by placing malicious links with `target="_blank"` or other triggers for `window.open()` in user-generated content. When a victim interacts with the link (UI:R), it causes the victim's operating system to open arbitrary URI schemes. This enables invoking local applications, opening local files, or triggering custom protocol handlers, potentially leading to high confidentiality, integrity, and availability impacts.
The GitHub security advisory (GHSA-6q44-85gc-cjvf) and Vikunja changelog for version 2.2.0 detail the patch, which resolves the issue by addressing the lack of validation in the Electron wrapper. Security practitioners should advise upgrading to version 2.2.0 or later to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14909
Vulnerability Data
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can…
more
place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized actors from invoking the custom URL handler by requiring approved authorizations for that entry point.
Least privilege limits the authorizations granted to the handler, reducing the chance that any actor can invoke it without restriction.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining, enforcing, and reviewing access permissions directly addresses the missing authorization checks for custom URL scheme handlers.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover missing authorization checks, but does not itself implement the required controls.
Enforces explicit authorization checks on which actors may invoke handlers, directly addressing the missing restriction on custom-URL-scheme access.
High-level access-control policy provides governance context but does not prescribe the technical authorization logic needed for URL-scheme handlers.
Requires security requirements that define which callers are permitted to trigger custom URL handlers, mitigating the authorization gap.
Mandates secure coding practices that include proper authorization checks before executing actions triggered by custom URL schemes.