Authorization Bypass in Vikunja Exposes Sensitive Data

Executive Summary

CVE-2026-56765 is a critical authorization flaw in Vikunja versions before 2.2.1 that allows unauthorized access and manipulation of data across an entire instance.

The vulnerability involves two main issues: first, the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, which enables attackers to escalate their permissions to admin-level shares.

Second, the GetTaskAttachment endpoint performs permission checks based on user-supplied task IDs but fetches attachments by sequential ID without verifying ownership. This allows attackers to download and delete all file attachments across all projects instance-wide.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-56765 allows unauthorized access to sensitive data and the ability to delete files across an entire Vikunja instance, resulting in an instance-wide data breach.

Such unauthorized data exposure and modification can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

The vulnerability's high severity and the ability for unauthenticated attackers to escalate privileges and access confidential files indicate a significant risk to compliance with these standards.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a severe instance-wide data breach, allowing unauthenticated attackers to access, download, and delete sensitive file attachments from any project within the Vikunja instance.

Attackers can escalate their permissions from read access to admin-level shares, compromising confidentiality and integrity of data.

The impact includes unauthorized disclosure of sensitive information and potential loss or destruction of important files, severely affecting the availability and trustworthiness of the system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unauthorized access attempts to the LinkSharing.ReadAll endpoint and the GetTaskAttachment endpoint in Vikunja instances before version 2.2.1.

Specifically, detection can focus on requests that attempt to enumerate share hashes or access task attachments by sequential IDs without proper authorization.

Commands or methods to detect exploitation attempts may include:

• Using web server logs or network monitoring tools to identify unusual GET or POST requests to endpoints like /api/v1/LinkSharing.ReadAll or /api/v1/GetTaskAttachment.
• Searching logs for repeated access attempts with sequential task attachment IDs that do not correspond to the requesting user's permissions.
• Example command to search logs for suspicious access to LinkSharing.ReadAll endpoint: `grep 'LinkSharing.ReadAll' /var/log/nginx/access.log`
• Example command to detect sequential access to task attachments: `grep 'GetTaskAttachment' /var/log/nginx/access.log | awk '{print $7}' | sort | uniq -c` to identify repeated or sequential attachment ID requests.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Vikunja to version 2.2.1 or later, where the vulnerability has been fixed.

This update removes the exposure of share hashes in the LinkSharing.ReadAll endpoint and enforces proper ownership verification in the GetTaskAttachment endpoint.

Until the upgrade can be applied, consider restricting access to the vulnerable endpoints by limiting network exposure, such as firewall rules or access controls, to trusted users only.

Additionally, monitor logs for suspicious activity as described in detection steps and revoke any suspicious or publicly shared links that could be exploited.

Useful 0 Not Useful 0