Skip to content
Threat Feed
Subscribe

Product

Vikunja (Before 2.2.1)

1 brief RSS
critical advisory

Authorization Flaws in Vikunja Expose Share Hashes and Allow Attachment Manipulation

Authorization flaws in Vikunja before version 2.2.1 allow authenticated users with read access to escalate privileges by obtaining admin-level share hashes via the LinkSharing.ReadAll endpoint, and also permit instance-wide data exfiltration and destruction by manipulating task attachments through an Insecure Direct Object Reference (IDOR) vulnerability in the GetTaskAttachment endpoint.

Vikunja authorization-bypass idor data-exfiltration data-destruction web-application cve
3t 1c