Verified

ghsa:GHSA-3HC7-R24J-RPWC: code.vikunja.io/api <= 2.5.0

Vikunja: Cross-project task disclosure through subtask expansion. Affected range: <= 2.5.0. Fixed version: 2.6.0.

Affected technology

code.vikunja.io/api · <= 2.5.0
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

A user with read access to one project can read the full content of tasks in other projects they were never granted access to, whenever those tasks are linked as subtasks (directly or recursively) under a task they can see.

Published 13-Oct-2026 07:48 UTC

Product: code.vikunja.io/api
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-09 22:06:25.045838+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-3hc7-r24j-rpwc.html