Vikunja 2.4.0 shipped on 19 July 2026, about three months and 1093 commits after 2.3.0 (156 of those commits were dependency bumps). Two things in it matter more than everything else. Ten security vulnerabilities are fixed, several of them nasty. And the project has started charging for features on self-hosted instances, which is the part the self-hosting crowd will be arguing about for a while.
The security half is straightforward: update. The Pro half is worth reading slowly, because plenty of the reaction is running ahead of what was actually announced.
Ten security fixes, most of them reported from outside
The maintainer’s wording in the changelog is “please update as soon as you can”. Most of the ten issues came from external researchers. They split into two groups.
The first group is broken access control around projects and kanban boards:
- Any user could read and complete anyone else’s tasks through the kanban view. The move-task endpoint checked whether you had access to the target bucket, but never checked the task itself (CVE-2026-55066).
- A link share could read the structure of any kanban board, including bucket names and who created them, which was enough to enumerate nearly every user on the instance.
- The layout of any kanban board could be wiped. Recovery was only possible from a backup (CVE-2026-55065).
- A project could be duplicated into someone else’s hierarchy. This one was found internally (CVE-2026-54766).
- Buckets could be added to someone else’s kanban board (CVE-2026-55067).
- A shared project could be detached without admin rights (CVE-2026-55064).
The second group covers authentication and credentials, and it is the worse half:
- API tokens belonging to other users could be created and deleted, via an internal ID collision triggered by repeatedly creating link shares.
- Account takeover through OIDC email fallback (CVE-2026-62367). With the non-default “email fallback” option enabled, Vikunja linked an SSO login to a local account by email address without checking that the provider had verified it. That allowed a takeover with no password.
- Password reset links were stored in plain text (CVE-2026-62376). Reset tokens, email confirmation tokens and account deletion tokens all sat unhashed in the database. They are hashed at rest now.
- A restricted API token could promote itself into a full session (CVE-2026-57458).
None of this needs an exotic setup to bite. If your instance has more than one account on it, or a link share pointed at anyone outside the house, the kanban bugs alone justify patching this week. The breakdown is in the official 2.4.0 changelog, and signed builds are on the GitHub release page.
What a Vikunja Pro licence key unlocks
Vikunja Pro is the project’s first paid offering for self-hosted instances, switched on by a licence key. Three features arrive with it in 2.4.0:
- An admin panel for instance-wide user and project management: listing accounts, promoting admins, disabling or deleting accounts, resetting a password.
- Time tracking, with time entries per task, a timer, a badge in the header plus a favicon indicator, and reports.
- Audit logs.
Pro is waitlist-only for now, opening up gradually over the following weeks. According to the changelog, 191 people had already joined the waitlist before the public announcement went out.
What the maintainer says is not changing
kolaente clearly expected the questions and answered them in the release post. These are his commitments, not our assessment of them:
- Nothing was removed. Free Vikunja under AGPLv3 is exactly as capable as it was in 2.3.0.
- No existing feature moved behind a paywall.
- Without a licence key, none of the Pro features appear and the app runs as before, with no upsell prompts.
- The Pro code lives in the same public repository under the same AGPLv3 licence. The key only switches the features on.
- If you stop paying, Vikunja keeps running and your data stays put. Only the Pro features turn off.
- SSO and LDAP remain free, and always have been.
- Ordinary task management features keep landing in the free version.
He frames the licence model as the main way to fund continued work on Vikunja and make the project sustainable. Whether that lands well with a community that has watched other self-hosted projects go through the same door is a separate question, and one worth watching over the next few releases rather than settling today.
A second API, with the first still supported
Every endpoint has been ported to a new API v2. The design is cleaner and more consistent, the docs are browsable at /api/v2/docs, error responses are structured, and partial updates now use PATCH. API v1 stays fully supported for the time being but will eventually go away. If you are starting a client today, target v2.
The rest of the release
Task descriptions are now Markdown. On API v2 you request them with ?format=markdown, and CalDAV always syncs descriptions as Markdown instead of a wall of HTML. There is emoji autocomplete by typing : followed by a shortcode, reply threads on comments, and bot user accounts for scripts and integrations: no password login, owned by a regular user, with a distinct avatar.
Accessibility got a serious pass. Keyboard navigation now reaches task links in list view, kanban cards, the task title, checkboxes and the editor toolbar. Focus rings are visible, label colours are picked by real contrast ratio, and screen readers get announcements for sort state and result counts.
Installation gets easier too, with native GPG-signed apt, rpm, pacman and apk repositories, so Debian, Ubuntu, Fedora, RHEL, Arch and Alpine each get a one-line install. There is also a new command line tool called veans for driving Vikunja from a terminal or an agent (OAuth login, tasks resolved by PROJ-NN or #NN, create, update, assign, list). Search results are now ranked by relevance on a ParadeDB backend, Greek and Persian were added, notifications have an Atom feed, and any day can be the start of the week.
On the fix side: CalDAV deletions now sync properly to iOS Reminders, ISO 8601 durations in weeks are handled, and a missing project returns a real 404. Recurring tasks go back to their original bucket.
What to do about it
Back up your database, then update. That is the whole recommendation for the security side, and it applies whether you care about Pro or not. If you are running Vikunja behind a reverse proxy with link shares handed out to people you do not fully trust, treat it as urgent rather than routine.
If you have not tried Vikunja yet, our Vikunja app profile covers what it does and how to deploy it. Start on 2.4.0 rather than an older tag.