Vikunja

vikunja.io Web, Android Linux

Awesome Privacy ➔ Productivity ➔ Cloud Productivity Suites ➔ Vikunja

Vikunja is an open-source to-do application. It is suitable for a wide variety of projects, supporting List, Gantt, Table and Kanban views to visualize all tasks in different contexts. For collaboration, it has sharing support via private teams or public links. It can be self-hosted or used as a managed service for a small fee.

Homepage: vikunja.io
GitHub: github.com/go-vikunja/vikunja
Web info: web-check.xyz/check/vikunja.io

Open Source

Vikunja Source Code

Author

go-vikunja

Description

The to-do app to organize your life.

#api#golang#project-management#self-hosted#todo#todoapp#todolist#vuejs

Homepage

https://vikunja.io

License

AGPL-3.0

Created

28 Nov 18

Last Updated

09 Jun 26

Latest version

Primary Language

Size

80,568 KB

Stars

4,476

Forks

492

Watchers

4,476

Language Usage

Star History

Top Contributors

Recent Commits

renovate[bot] (08 Jun 26)
chore(deps): update dev-dependencies to v8.61.0
Claude (09 Jun 26)
feat(labels): let bot owners manage labels created by their bots Bot owners inherit read/update/delete permission on labels created by bots they own, mirroring the bot-owner branch already used by API tokens (see api_tokens_permissions.go). Without this, a label a bot creates is permanently locked to that bot and the human owner cannot maintain it. https://claude.ai/code/session_016x6mUPJuuQEeXpHY814iLh
kolaente (09 Jun 26)
chore(deps): update devenv
Frederick [Bot] (09 Jun 26)
chore(i18n): update translations via Crowdin
Frederick [Bot] (08 Jun 26)
[skip ci] Updated swagger docs
kolaente (08 Jun 26)
refactor(time-tracking): drop the now-redundant duration clamp in the entry list
kolaente (08 Jun 26)
fix(time-tracking): reject inverted time-entry intervals
kolaente (08 Jun 26)
test(time-tracking): add end-to-end coverage
kolaente (08 Jun 26)
i18n(time-tracking): add the time-tracking UI strings
kolaente (08 Jun 26)
feat(time-tracking): configure the smart-fill start time in settings
kolaente (08 Jun 26)
feat(time-tracking): add the time-tracking view
kolaente (08 Jun 26)
feat(time-tracking): add the task-detail time-tracking section
kolaente (08 Jun 26)
feat(time-tracking): add the sidebar navigation entry
kolaente (08 Jun 26)
feat(time-tracking): show a running-elsewhere badge in the header
kolaente (08 Jun 26)
feat(time-tracking): add the timer badge
kolaente (08 Jun 26)
feat(time-tracking): add the time-entry list
kolaente (08 Jun 26)
feat(time-tracking): add the time-entry form
kolaente (08 Jun 26)
feat(time-tracking): extract the smart-fill start computation
kolaente (08 Jun 26)
feat(date): accept a null modelValue in DatepickerWithRange
kolaente (08 Jun 26)
feat(date): show the matching preset name on the date-range button
kolaente (08 Jun 26)
feat(input): add quick-select shortcuts to the Datepicker
kolaente (08 Jun 26)
feat(time-tracking): add the time-tracking store
kolaente (08 Jun 26)
feat(time-tracking): add the v2 time-entry service
kolaente (08 Jun 26)
refactor(config): add PRO_FEATURE constants for licensed features
kolaente (08 Jun 26)
fix(api/v2): expose v2-only token route groups via the routes endpoint
kolaente (08 Jun 26)
fix(api/v2): group time-entries token routes under their own scope
kolaente (08 Jun 26)
test(time-tracking): cover the v2 time-entry routes
kolaente (08 Jun 26)
test(time-tracking): cover the time_entries model
kolaente (08 Jun 26)
feat(time-tracking): let clients subscribe to timer events
kolaente (08 Jun 26)
feat(time-tracking): broadcast timer changes over websocket

Vikunja Security

Security Advisories (36)

medium Unpatched CVSS 4.3

CVE-2026-40103 Scoped API tokens with projects.background permission can delete project backgrounds

09 Apr 26
high Patched CVSS 7.4

CVE-2026-34727 TOTP Two-Factor Authentication Bypass via OIDC Login Path

09 Apr 26
medium Patched CVSS 4.1

CVE-2026-35601 iCalendar Property Injection via CRLF in CalDAV Task Output

09 Apr 26
medium Patched CVSS 5.4

CVE-2026-35600 HTML Injection via Task Titles in Overdue Email Notifications

09 Apr 26
medium Patched CVSS 6.5

CVE-2026-35599 Algorithmic Complexity DoS in Repeating Task Handler

09 Apr 26
medium Patched CVSS 5.4

CVE-2026-35602 File Size Limit Bypass via Vikunja Import

09 Apr 26
medium Patched CVSS 4.3

CVE-2026-35598 Missing Authorization on CalDAV Task Read

09 Apr 26
medium Patched CVSS 5.9

CVE-2026-35597 TOTP Brute-Force Due to Non-Functional Account Lockout

09 Apr 26
medium Patched CVSS 4.3

CVE-2026-35596 Broken Access Control on Label Read via SQL Operator Precedence Bug

09 Apr 26
high Patched CVSS 8.3

CVE-2026-35595 Privilege Escalation via Project Reparenting

09 Apr 26
medium Patched CVSS 6.5

CVE-2026-35594 Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

09 Apr 26
medium Patched

CVE-2026-33700 Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

23 Mar 26
high Patched

CVE-2026-33668 Disabled/Locked User Accounts Can Still Authenticate via API Tokens, CalDAV, and OpenID Connect

23 Mar 26
medium Patched CVSS 6.4

CVE-2026-33679 SSRF via OpenID Connect Avatar Download Bypasses Webhook SSRF Protections

23 Mar 26
medium Patched CVSS 6.4

CVE-2026-33675 SSRF via Todoist/Trello Migration File Attachment URLs Allows Reading Internal Network Resources

23 Mar 26
medium Patched CVSS 6.5

CVE-2026-33676 Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

23 Mar 26
medium Patched CVSS 6.5

CVE-2026-33677 Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

23 Mar 26
high Patched CVSS 8.1

CVE-2026-33678 IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

23 Mar 26
high Patched CVSS 7.5

CVE-2026-33680 Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

23 Mar 26
critical Patched CVSS 9.1

GHSA-2pv8-4c52-mf8j Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

23 Mar 26
high Unpatched

CVE-2026-33334 Any frontend XSS escalates to Remote Code Execution due to nodeIntegration in Vikunja Desktop

20 Mar 26
high Unpatched

CVE-2026-33335 Arbitrary local application invocation via unvalidated shell.openExternal in Vikunja Desktop

20 Mar 26
critical Unpatched

CVE-2026-33336 Remote Code Execution via same-window navigation in Vikunja Desktop

20 Mar 26
medium Patched

CVE-2026-33313 IDOR in Task Comments Allows Reading Arbitrary Comments

20 Mar 26
medium Unpatched

CVE-2026-33312 Read-only users can delete project background images via broken object-level authorization

20 Mar 26
medium Patched

CVE-2026-33315 2FA Bypass via Caldav Basic Auth

20 Mar 26
high Patched CVSS 8.1

CVE-2026-33316 Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

20 Mar 26
medium Unpatched CVSS 5.7

CVE-2026-33473 TOTP Reuse During Validity Window

20 Mar 26
high Unpatched

CVE-2026-33474 DoS via Image Preview Generation

20 Mar 26
medium Unpatched CVSS 5.3

CVE-2026-29794 Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

20 Mar 26
critical Patched CVSS 9.8

CVE-2026-28268 Account Takeover via Password Reset Token Reuse

27 Feb 26
high Patched CVSS 7.2

CVE-2026-27819 Path Traversal in CLI Restore

25 Feb 26
critical Patched CVSS 9.1

CVE-2026-27575 Weak Password Policy Combined with Persistent Sessions After Password Change

25 Feb 26
high Patched CVSS 7.3

CVE-2026-27616 Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

25 Feb 26
medium Patched CVSS 6.1

CVE-2026-27116 Reflected HTML Injection via filter Parameter in Projects Module

25 Feb 26
high Unpatched

CVE-2026-25935 XSS Via Task Preview

11 Feb 26

Vikunja Website

Website

Vikunja: The task manager you actually own

Vikunja is open-source task management you can self-host. Lists, Kanban, Gantt, and more — on your server or ours. Made and hosted in the EU.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

IP Address 104.21.47.206
Location San Francisco, California, United States of America, NA
ISP CloudFlare Inc.
ASN AS13335

Associated Countries

Safety Score

Website marked as safe

100%

Blacklist Check

vikunja.io was found on 0 blacklists

AntiSocial Blacklist
Artists Against 419
Badbitcoin
Bambenek Consulting
CERT Polska
CoinBlockerLists
CRDF
CryptoScamDB
EtherAddressLookup
EtherScamDB
Fake Website Buster
MetaMask EthPhishing
NABP Not Recommended Sites
OpenPhish
PetScams
PhishFeed
PhishFort
Phishing.Database
PhishStats
PhishTank
Phishunt
RPiList Not Serious
Scam.Directory
SecureReload Phishing List
Spam404
StopGunScams
Suspicious Hosting IP
ThreatFox
ThreatLog
TweetFeed
URLhaus
ViriBack C2 Tracker

Website Preview

View full report at web-check.xyz

Vikunja Docker

Container Info

Vikunja

The to-do app to organize your life.| Before use create custom template and Edit: VIKUNJA_SERVICE_FRONTENDURL , VIKUNJA_API_URL & VIKUNJA_SERVICE_JWTSECRET

#Tools#Productivity

Run Command

docker run -d \
  -e PUID=${PUID} \
  -e PGID=${PGID} \
  -e PORT=${PORT} \

Compose File

version: 3.8
services:
  vikunja:
    environment:
      PUID: 1000
      PGID: 1000
      PORT:

Environment Variables

Var Name Default
PUID 1000
PGID 1000
PORT null

Vikunja Reviews

More Cloud Productivity Suites

CryptPad

(Web)
cryptpad.org

A zero knowledge cloud productivity suite. Provides Rich Text, Presentations, Spreadsheets, Kanban, Paint a code editor and file drive. All notes and user content, are encrypted by default, and can only be accessed with specific URL. The main disadvantage, is a lack of Android, iOS and desktop apps - CryptPad is entirely web-based. You can use their web service, or you can host your own instance. Price for hosted: free for 50mb or $5/ month for premium.

Open Source xwiki-labs/cryptpad

View CryptPad Report
Disroot

(Web)
disroot.org

A platform providing online services based on principles of freedom, privacy, federation and decentralization. It is an implementation of NextCloud, with strong encryption configured - it is widely used by journalists, activists and whistle-blowers. It is free to use, but there have been reported reliability issues of the cloud services.

View Disroot Report
NextCloud

(Web, Windows, Mac OS, Linux, Android, iOS)
nextcloud.com

A complete self-hosted productivity platform, with a strong community and growing app store. NextCloud is similar to (but arguably more complete than) Google Drive, Office 365 and Dropbox. Clear UI and stable native apps across all platforms, and also supports file sync. Supports encrypted files, but you need to configure this yourself. Fully open source.

Open Source nextcloud/server

View NextCloud Report
Sandstorm

(Web)
sandstorm.io

An open source platform for self-hosting web apps. Once you've set it up, you can install items from the Sandstorm App Market with -click, similar to NextCloud in terms of flexibility.

Open Source sandstorm-io/sandstorm

View Sandstorm Report

About the Data: Vikunja

Change History

Added Jul 21, 2022 by @kolaente #36

API

You can access Vikunja's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/vikunja

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Vikunja

Help your friends compare Cloud Productivity Suites, and pick privacy-respecting software and services.
Share Vikunja and Awesome Privacy with your network!

← Previous

Sandstorm

View Cloud Productivity Suites (5)

Vikunja

Avoid

Also Consider

Vikunja Source Code

Author

Description

Homepage

License

Created

Last Updated

Latest version

Primary Language

Size

Stars

Forks

Watchers

Language Usage

Star History

Top Contributors

Recent Commits

Vikunja Security

Security Advisories (36)

Vikunja Website

Website

Redirects

Security Checks

Server Details

Associated Countries

Safety Score

Blacklist Check

Website Preview

Vikunja Docker

Container Info

Run Command

Compose File

Environment Variables

Vikunja Reviews

More Cloud Productivity Suites

CryptPad

Disroot

NextCloud

Sandstorm

About the Data: Vikunja

Change History

API

Share Vikunja