Vikunja is a self-hosted task and project manager. It can hold project plans, attachments, comments, and integrations that move data to other services. An exposed login page is only the first object in a useful review. The project sharing model and API token scope determine what an authenticated or link-based visitor can reach.
A ZoomEye SDK count-only query on November 2, 2026 returned 540 matches for app="Vikunja" and 1,705 for title="Vikunja". The queries used sub_type=all, page 1, and a page size of 1. The application fingerprint is more specific than the title, while the title result suggests that a title-only inventory would miss or overcount deployments.
Vikunja supports sharing with users, teams, and link shares. The documentation describes Read, Read & Write, and Admin permission levels. Link shares can let someone use a project without an account. Permissions can also be inherited through parent projects. API tokens are created in settings and carry permission choices for operations such as project management, tasks, comments, and webhooks.
Those features create several review paths:
- 1.
Inventory projects with public or link shares and confirm the intended permission level.
- 2.
Check password-protected links, expiration behavior where configured, and the owner of each share.
- 3.
Review parent and sub-project inheritance rather than inspecting a child project in isolation.
- 4.
Enumerate API tokens by owner, permission set, last use, and expiry.
- 5.
Check webhooks that send project events to external endpoints and the signing or authentication they require.
- 6.
Confirm that deleted users, teams, and shares no longer retain effective access.
An external count cannot distinguish a private task list from a project containing operational secrets. It also cannot show whether a link share has a weak or absent password. The count is useful for finding internet-facing instances, but the risk decision belongs to the project and token inventory.
Test the permission model with two accounts. Give one account read access through a team and another through a direct share, then verify the maximum permission the API reports. Try to use a task-level token on a project-management endpoint. A token should fail outside its declared scope even when the user can perform the operation in the web interface.
Vikunja's sharing design is practical for collaboration. The security team should treat link sharing, inherited permissions, and broad API tokens as separate authorization surfaces rather than assuming the login screen represents the whole boundary.
Query evidence
app="Vikunja" returned 540 matches. title="Vikunja" returned 1,705. Both queries used sub_type=all, page 1, and a page size of 1.