Vikunja CVE-2026-33680

Vikunja versions prior to 2.2.2. Attacker must possess a valid read-only link share for a project. Remote unauthenticated attacker can exploit via the ReadAllWeb handler to enumerate and retrieve secret hashes of write/admin link shares, enabling privilege escalation.

The CVSS score of 7.5 (High) reflects a network-accessible vulnerability with low attack complexity requiring no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), though the confidentiality impact is high with no integrity or availability impact (C:H/I:N/A:N). However, the actual privileges required (PR:N) appears miscalibrated as the description clearly states an attacker needs a read-only link share to exploit this, suggesting PR:L would be more accurate. The real-world risk is significant because exploitation is straightforward once an attacker obtains any valid link share—they can immediately escalate to admin privileges on the project. The vulnerability has a clear exploitation path with a public patch commit available at GitHub (9efe1fadba817923c7c7f5953c3e9e9c5683bbf3), making it trivial for attackers to reverse-engineer the flaw. Despite the lack of EPSS score or KEV listing in the provided data, the combination of network accessibility, low complexity, and privilege escalation to admin makes this a genuine priority for organizations running Vikunja, particularly those using link sharing features for collaboration.

An attacker obtains a legitimate read-only link share URL for a Vikunja project, either through social engineering, intercepted communications, or from a public sharing scenario. The attacker authenticates using this read-only link share and calls the ReadAllWeb API endpoint to retrieve all link shares for that project, including the secret hashes for write-level and admin-level shares. Using these exposed admin link share hashes, the attacker re-authenticates with full admin privileges, gaining complete control over the project including the ability to modify tasks, delete data, and manage user permissions.