---
title: "GHSA-2pv8-4c52-mf8j: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR"
url: https://erroneo.us/security/ghsa/GHSA-2pv8-4c52-mf8j/
description: "GHSA-2pv8-4c52-mf8j (critical, Go): Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment…"
type: advisory
section: "Security Digest"
date_published: 2026-03-26
date_modified: 2026-03-26
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2pv8-4c52-mf8j"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2pv8-4c52-mf8j: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

## Affected packages

- Go `code.vikunja.io/api` <= 2.2.0 → fixed: 2.2.1

## Details

Summary Two independently-exploitable authorization flaws in Vikunja can be chained to allow an unauthenticated attacker to download and delete every file attachment across all projects in a Vikunja instance. The ReadAll endpoint for link shares exposes share hashes (including admin-level shares) to any user with read access, enabling permission escalation. The task attachment ReadOne/GetTaskAttachment endpoint performs permission checks against a user-supplied task ID but fetches the attachment by its own sequential ID without verifying the attachment belongs to that task, enabling cross-project file access. Details Vulnerability 1: Link Share Hash Disclosure (Permission Escalation Entry Point) Tracked in https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9 The LinkSharing.ReadAll() method in pkg/models/linksharing.go:228-287 returns all link shares for a project, including the Hash field: The ReadAll clears passwords but not hashes: A link share user with read-only access can call GET /api/v1/projects/:project/shares (routed at pkg/routes/routes.go:483) to discover all shares, then authenticate with an admin-level share hash. Vulnerability 2: Cross-Project Attachment IDOR (Data Exfiltration) Tracked in https://github.com/go-vikunja/vikunja/security/advisories/GHSA-jfmm-mjcp-8wq2 The GetTaskAttachment handler in pkg/routes/api/v1/taskattachment.go:156-186 performs the permission check against the task ID supplied in the URL: But ReadOne fetches the attachment by its own ID, ignoring the task: This means: specify a task you CAN access, but an attachment ID from a different project → permission check passes, wrong attachment is returned. The Chain PoC Prerequisites: A Vikunja instance with at least one link share (any permission level). The attacker only needs the link share URL. Impact Confidentiality (HIGH): An attacker with a single publicly-shared link share URL can download every file attachment across all projects in the Vikunja instance. Attachment IDs are sequential integers, making enumeration trivial. This includes confidential documents, images, and any files uploaded by any user in any project. Integrity (HIGH): With the permission escalation from read-only to admin (via hash disclosure), the attacker can delete attachments…

## Sources

- [GitHub Advisory GHSA-2pv8-4c52-mf8j](https://github.com/advisories/GHSA-2pv8-4c52-mf8j)
- [github.com](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2pv8-4c52-mf8j)
- [github.com](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8hp8-9fhr-pfm9)
- [github.com](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-jfmm-mjcp-8wq2)
- [vikunja.io](https://vikunja.io/changelog/vikunja-v2.2.2-was-released)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2pv8-4c52-mf8j/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt