ghsa:GHSA-9JRX-VMH8-C6XW: code.vikunja.io/api >= 0.22.0, <= 2.3.0

Affected technology

code.vikunja.io/api · >= 0.22.0, <= 2.3.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Source advisory’s CVSS 3.1 assessment rates confidentiality and integrity impact as high; availability impact as none.