Executive brief
Vikunja, an open-source to-do list application, contains a security flaw that allows any logged-in user to view labels from other users' private projects. By exploiting this bug, an attacker can see label names, descriptions, and the usernames of the people who created them. This could lead to the exposure of sensitive project metadata or internal organizational details.
Technical details
A SQL operator precedence bug exists in the `hasAccessToLabel` function within `pkg/models/label_permissions.go`. The application uses the xorm library to construct a query chain (`.Where().Or().And()`) that results in a SQL `WHERE` clause without proper grouping. Because SQL `AND` has higher precedence than `OR`, the label ID constraint only applies to the final project access condition, leaving the check for task associations unconstrained. An authenticated attacker can enumerate sequential label IDs to disclose label titles, descriptions, colors, and creator usernames for any label associated with at least one task. The issue is fixed in version 2.3.0 by using explicit grouping in the query builder.
Affected products
- Vikunja Vikunja <= 2.2.2
Timeline
- 2026-04-09: disclosed
- 2026-04-09: patched: Fixed in version 2.3.0
- 2026-04-10: advisory