Vikunja User Enumeration via Link-Share Token Validation Flaw

Executive Summary

Vikunja versions before 2.6.0 have a flaw where link-share tokens in the v2 API user search endpoints are not properly validated. Attackers with a read-only share link can exploit this to enumerate project users through the projects endpoint and confirm arbitrary usernames via the global search endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a version before 2.6.0. Use commands like 'curl -s http://your-vikunja-server/api/version' or inspect the server's package manager (e.g., 'dpkg -l | grep vikunja' for Debian-based systems). If vulnerable, test the endpoints '/api/v2/projects/{id}/users/search' and '/api/v2/users?q=<name>' with a valid link-share token to see if user enumeration is possible.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gather information about users in a project or system. They can confirm which usernames exist, potentially aiding further attacks like phishing or brute force attempts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing internal user identities (usernames and display names) without proper authorization. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. User enumeration may violate data minimization and access control principles, potentially leading to unauthorized data exposure and increased risk of phishing or credential stuffing attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.6.0 or later to address the improper validation of link-share tokens in the v2 API user search endpoints.

Useful 0 Not Useful 0