Vikunja EUVD-2026-42890

Exploitation requires that the target Vikunja instance expose the LinkSharing and task-attachment API endpoints over the network and, for fully unauthenticated abuse, that at least one public (password-less) link share exists to provide the initial read access that leaks admin-level share hashes; the chain then abuses predictable sequential attachment IDs, so no per-file authorization is needed. The primary limiting factor is the presence and reachability of link shares - an instance with no public shares and network access restricted to authenticated users substantially raises the bar, and only versions before 2.2.1 are affected. Beyond that, the CVSS vector confirms no user interaction and no privileges are required (PR:N/UI:N) against a reachable instance.

The signals point to a genuine high-priority issue rather than an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no privileges or user interaction, and high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - the availability impact is real because the flaw permits deletion, not just reading, of attachments. The reporter (VulnCheck) characterizes the full chain as an unauthenticated instance-wide breach, consistent with Vikunja link shares that can be public. Note a nuance to verify: the description frames the first flaw as affecting 'users with read access,' which implies at least link-share-level access, yet the vector and advisory title assert unauthenticated exploitation - this reconciles only if a public (password-less) link share exists on the instance, so PR:N is realistic for typical deployments but not guaranteed for every configuration. No EPSS score was provided, so exploitation-probability cannot be quantified here; there is no KEV listing and no POC referenced, meaning exploitation is plausible and easy but not yet observed in the wild. Overall: patch promptly given the low attack complexity and destructive potential, tempered by Vikunja's modest deployment footprint.

An attacker who can reach a Vikunja instance - for example via any public link share - calls LinkSharing.ReadAll to harvest higher-privilege share hashes, then uses that access to invoke GetTaskAttachment while incrementing the sequential attachment ID. By walking the ID space they download every file attachment on the server regardless of project ownership, and can issue delete requests to destroy them. No public POC is referenced, but the low attack complexity (AC:L, no user interaction) makes weaponization straightforward.