CVE-2026-56765CWE-639

Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

Critical · published July 10, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches attachments by sequential ID without verifying ownership, allowing attackers to download and delete all file attachments across all projects instance-wide.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-10T13:57Z
EPSS history
Timeline
  • 10 JUL 13:57Z
    Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR
    cvelistv5