Executive brief
Vikunja is an open-source project and task management platform. A vulnerability in versions before 2.6.0 allows anyone with a read-only share link to enumerate all users in a project and search for the existence of any username across the entire instance. This information disclosure risk is particularly serious because share links are often forwarded or semi-public, potentially putting internal user directories in the hands of untrusted recipients who could use this data for phishing and credential-stuffing attacks.
Technical details
The vulnerability is an authentication bypass in Vikunja's v2 API where link-share tokens (low-privilege JWTs meant only to access shared projects) are not properly validated. Two endpoints are affected: GET /api/v2/projects/{id}/users/search returns the full member list of a project and its parents, and GET /api/v2/users?q=<name> functions as a global username oracle that confirms whether any account exists on the instance. The v1 versions of these endpoints correctly reject link-share tokens, but v2 handlers only check project.CanRead without verifying caller privileges. An attacker needs only a share link (no additional account required); they can iterate over wordlists to enumerate accounts or extract the project membership hierarchy. The fix, available in version 2.6.0, properly validates callers using GetFromAuth to reject link-share tokens as the v1 API already does.
Affected products
- Vikunja Vikunja < 2.6.0
Timeline
- 2026-08-31: disclosed
- 2026-09-15: patched: Version 2.6.0 released with fix