{"id":"GO-2026-6739","revision":"76150cb73f41458fac2d69a38e5000ed","records":[{"revision":"76150cb73f41458fac2d69a38e5000ed","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6739","aliases":["CVE-2026-111922","GHSA-m687-p538-r5hp"],"title":"Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api","description":"Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .","state":0,"publishedAt":"2026-10-19T21:08:26+00:00","modifiedAt":"2026-10-19T21:40:54.8358442+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6739","license":"OSV · upstream source license applies","key":"osv:GO-2026-6739","identifiers":["GO-2026-6739","CVE-2026-111922","GHSA-m687-p538-r5hp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}