Executive brief
Vikunja is an open-source task management platform. A security flaw in its CalDAV implementation allows any logged-in user to view the details of tasks belonging to other users or private projects if they know the task's unique identifier. This could lead to the exposure of sensitive information such as task titles, descriptions, and due dates across different organizations or teams using the same instance.
Technical details
A missing authorization vulnerability exists in Vikunja's CalDAV implementation within the GetResource and GetResourcesByList methods. The underlying function GetTasksByUIDs in pkg/models/tasks.go performs a global database query using task UIDs without verifying if the requesting user has permission to access the associated project. An attacker with valid CalDAV credentials can bypass project-level access controls by requesting a task's .ics file directly, even if the task belongs to a private project they do not own. While task UIDs are UUIDv4, they may be obtained through sync logs or shared calendar contexts. The issue is addressed in version 2.3.0.
Affected products
- Vikunja Vikunja <= 2.2.2
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 2.3.0