Vikunja EUVD-2026-14927

While a formal CVSS score is not provided, the vulnerability exhibits medium-to-high practical risk based on available signals. The attack vector is network-based and requires authentication (project admin role), which moderately reduces exposure compared to unauthenticated attacks. However, the root cause (CWE-639) is well-understood and straightforward to exploit—an attacker need only enumerate share IDs and project IDs, both typically sequential or discoverable. No EPSS score or KEV status is reported, but the GitHub security advisory reference indicates this was formally tracked by the vendor, suggesting credible researcher involvement. A proof-of-concept likely exists given the simplicity of the authorization bypass (crafting a DELETE request with attacker-controlled project/share ID pairs). The real-world impact is moderate: an admin user can disrupt link sharing for other projects, potentially denying legitimate users access to shared tasks. The vulnerability is not a remote code execution or data exfiltration vector, but it does enable privilege escalation across project boundaries and is highly automatable.

An attacker with administrative privileges on Project A discovers the project IDs and link share IDs of other projects in the Vikunja instance (e.g., via enumeration or reconnaissance). The attacker then crafts DELETE requests to /api/v1/projects/[other_project_id]/shares/[target_share_id] using their own authentication token and the target project's ID in the URL path. The server fails to verify that the share belongs to the specified project, allowing the DELETE to succeed, thereby revoked external access to the target project's shared links. This can be automated to disrupt multiple projects with a simple loop over enumerated IDs.