Get real-time updates on Telegram
ghsa:GHSA-37RX-7PJ5-P885: code.vikunja.io/api <= 2.5.0
Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level. Affected range: <= 2.5.0.
Affected technology
code.vikunja.io/api · <= 2.5.0
Vendor not specified by the source
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions. Source advisory’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as none.
- Product
- code.vikunja.io/api
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-09 22:06:25.045838+00:00 UTC
Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-37rx-7pj5-p885.html