EUVD-2026-42890
GHSA-pg6g-jf8c-49p7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity IDOR exploitable without privileges or interaction via public link shares (PR:N/UI:N); reading exposes files (C:H) and deletion affects integrity and availability (I:H/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches attachments by sequential ID without verifying ownership, allowing attackers to download and delete all file attachments across all projects instance-wide.
AnalysisAI
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment across all projects on a server. Two flaws chain together: the LinkSharing.ReadAll endpoint leaks share hashes to any user with read access, enabling escalation to admin-level shares, and the GetTaskAttachment endpoint validates permissions against a user-supplied task ID while fetching the attachment by an unrelated sequential ID, an insecure-direct-object-reference that ignores ownership. Rated CVSS 4.0 9.3 (critical) with a network, unauthenticated vector; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Vikunja is a self-hosted open-source task/to-do management application (the affected component is the Go backend, cpe:2.3:a:vikunja:vikunja). The root cause class is CWE-639, Authorization Bypass Through User-Controlled Key (a form of IDOR). In GetTaskAttachment the server performs its access-control check against a task ID the caller supplies, but then retrieves the attachment record by its own auto-incrementing primary key without confirming that the attachment actually belongs to that task or that the caller owns it. Because attachment IDs are sequential and predictable, an attacker can enumerate them to reach files belonging to other projects and users. Separately, the LinkSharing.ReadAll listing endpoint returns share hashes - the secret tokens that grant access to a link share - to anyone with mere read permission, including higher-privilege admin share hashes, which turns a low-privilege foothold into full share control.
RemediationAI
Vendor-released patch: 2.2.1 - upgrade all Vikunja instances to 2.2.1 or later as the primary fix, per GHSA-2pv8-4c52-mf8j (https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2pv8-4c52-mf8j). If you cannot upgrade immediately, reduce exposure by disabling or deleting public/anonymous link shares so the hash-disclosure entry point is removed (trade-off: legitimate share-based collaboration breaks), and restrict network reachability of the Vikunja instance to trusted users via VPN, IP allow-listing, or an authenticating reverse proxy in front of the API (trade-off: complicates external sharing but blocks anonymous access to the vulnerable endpoints). Because the flaw allows deletion of attachments, ensure current backups of the attachment store and database exist before and after remediation so any tampering can be recovered. After patching, audit link shares and attachment access logs for signs of prior enumeration.
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Vikunja, an open-source self-hosted task management platform, contains an insecure direct object reference (IDOR) vulner
Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today