ghsa:GHSA-VCGV-7RVM-M3VP: code.vikunja.io/api <= 2.5.0

Affected technology

code.vikunja.io/api · <= 2.5.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint. Source advisory’s CVSS 3.1 assessment rates confidentiality impact as low; integrity and availability impact as none.