Privilege Escalation in Vikunja via Bot Deletion

Executive Summary

This vulnerability in Vikunja (versions 0.18.0 to 2.7.0) allows team owners to escalate privileges by deleting accounts. Attackers can create a bot, add it to their team, then delete it via the bots endpoint. This triggers a function that promotes the bot to project admin or owner, locking out the original owner. The flaw stems from improper privilege management and incorrect authorization checks.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unauthorized bot creation or account deletions in Vikunja. Check logs for suspicious activity in the bots endpoint or project share modifications. Look for sudden ownership changes in read-only shared projects.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized admin access to your projects, allowing them to edit or delete project content. They could also take ownership of projects, locking you out. Even accidental account deletions by collaborators may trigger this issue, promoting their access and transferring ownership without notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later. Review and revoke unnecessary bot accounts. Audit project ownership and shares for unauthorized changes. Implement stricter access controls and monitor for suspicious deletions.

Useful 0 Not Useful 0