CVE-2026-56765
CriticalCVSS 9.8Summary
A vulnerability in Vikunja before version 2.2.1 allows unauthorized access to share hashes and downloading/deleting all file attachments across the instance. An authorization flaw in the LinkSharing.ReadAll and GetTaskAttachment endpoints enables privilege escalation to admin-level shares.
Risk Assessment
The organization is at risk of sensitive data leakage and loss of file integrity, as an attacker can download and delete all attachments in the instance and gain access to admin-level shares.
Recommendation
Immediately upgrade Vikunja to version 2.2.1 or later, which includes authorization fixes for the LinkSharing.ReadAll and GetTaskAttachment endpoints.
Original NVD description (English source)
Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches attachments by sequential ID without verifying ownership, allowing attackers to download and delete all file attachments across all projects instance-wide.