PT-2026-57178 · Vikunja · Vikunja

Offset · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-56765

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.2.1

Description Two chained authorization flaws exist in the software. The 'LinkSharing.ReadAll' endpoint exposes share hashes to users with read access, which allows for permission escalation to admin-level shares. Additionally, the 'GetTaskAttachment' endpoint performs permission checks against a user-supplied task ID but retrieves attachments using sequential IDs without verifying ownership. This allows an attacker to enumerate sequential IDs to download and delete all file attachments across all projects instance-wide, resulting in a full data breach.

Recommendations Update to version 2.2.1.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-56765

Affected Products

Vikunja

References · 6

• 🔥 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2pv8-4c52-mf8j · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56765 · Security Note
• https://twitter.com/UpwindMDR/status/2075627760236839420 · Twitter Post
• https://twitter.com/UpwindMDR/status/2075609865834344520 · Twitter Post
• https://twitter.com/OrizonCyber/status/2075603482627752434 · Twitter Post
• https://vulncheck.com/advisories/vikunja-unauthenticated-instance-wide-data-breach-via-link-share-hash-disclosure-chained-with-cross-project-attachment-idor · Note