GHSA-2pv8-4c52-mf8j: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with govulncheck ./....
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary

Two independently-exploitable authorization flaws in Vikunja can be chained to allow an unauthenticated attacker to download and delete every file attachment across all projects in a Vikunja instance. The ReadAll endpoint for link shares exposes share hashes (including admin-level shares) to any user with read access, enabling permission escalation. The task attachment ReadOne/GetTaskAttachment endpoint performs permission checks against a user-supplied task ID but fetches the attachment by its own sequential ID without verifying the attachment belongs to that task, enabling cross-project file access.

Details

Vulnerability 1: Link Share Hash Disclosure (Permission Escalation Entry Point)

Tracked in https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9

The LinkSharing.ReadAll() method in pkg/models/linksharing.go:228-287 returns all link shares for a project, including the Hash field:

The ReadAll clears passwords but not hashes:

A link share user with read-only access can call GET /api/v1/projects/:project/shares (routed at pkg/routes/routes.go:483) to discover all shares, then authenticate with an admin-level share hash.

CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Sources and references

1. GitHub Advisory GHSA-2pv8-4c52-mf8j github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. vikunja.io vikunja.io

Critical Go advisories · Today’s Security Digest