Unauthorized Team Enumeration in Vikunja

Executive Summary

This vulnerability in Vikunja before version 2.6.0 allows authenticated users to enumerate all teams and their members by attaching arbitrary team IDs to projects. The system fails to validate whether the user has access to the team, only checking if they are a project admin. This exposes team rosters, member names, and admin flags for unauthorized teams.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a version before 2.6.0. Use commands like 'curl -s http://your-vikunja-url/api/v1/info | grep version' to verify the version. If vulnerable, authenticated users can enumerate teams by creating a project and attaching arbitrary team IDs via the project teams endpoint.

Monitor API logs for repeated requests to the project teams endpoint with varying team IDs. Suspicious activity may include unauthorized team roster retrievals or repeated project creation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials could gather sensitive organizational data, including team structures and member identities, without proper authorization. This could lead to further targeted attacks, privacy violations, or unauthorized access to restricted information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing personally identifiable information without proper authorization. It undermines principles of least privilege and data minimization, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.6.0 or later immediately. This patch addresses the team access validation flaw. If upgrading is not possible, restrict project admin privileges to trusted users only and monitor team membership changes closely.

Review and audit all project team attachments to identify unauthorized access attempts. Disable or restrict the project teams API endpoint if not required for operations.

Useful 0 Not Useful 0