Vikunja EUVD-2026-14921

Vikunja versions prior to 2.2.1. Attacker must be an authenticated user with access to any task. Exploits sequential attachment IDs to enumerate and access attachments from other projects via direct ID manipulation in URL.

This vulnerability presents a high real-world risk despite requiring authentication (PR:L). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network-based exploitation with low complexity and no user interaction, targeting both confidentiality and integrity. The attack is highly automatable—an authenticated attacker can script enumeration of sequential attachment IDs to systematically exfiltrate or delete attachments across the entire platform. The technical impact is significant as it bypasses the intended multi-tenant isolation in a collaborative task management system. While no EPSS score or KEV status is provided, the straightforward exploitation path, combined with the sequential ID scheme making enumeration trivial, elevates this beyond a theoretical issue. Organizations using Vikunja should prioritize patching, particularly if the platform contains sensitive project documentation or if untrusted users have authenticated access.

An authenticated attacker with a legitimate Vikunja account creates or accesses any task they have permission to view, then crafts API requests using their valid task ID in the URL path while iterating through sequential attachment IDs in the request body. Since attachment IDs are sequential integers, the attacker can systematically enumerate from ID 1 upward, downloading or deleting attachments that belong to other users' private tasks across different projects, completely bypassing the intended access controls and potentially exfiltrating sensitive project documentation or sabotaging collaborative work.