Executive brief
Vikunja is a task and project management platform that allows projects to be shared via secure link shares with configurable permission levels. A critical flaw allows read-only project members to retrieve the secret access hash from the share's read endpoint, then exchange it for a higher-privileged token to perform writes or administrative actions they should not have access to. This enables unauthorized data modification and potential project compromise.
Technical details
The vulnerability is an access control bypass in the single-share read endpoints (GET /api/v1/projects/{project}/shares/{share} and v2 equivalent). These endpoints check only project.CanRead() permission, which permits any read-level member, but then serialize and return the hash field—a secret bearer credential used to obtain link-share JWTs. The attacker can take this disclosed hash and POST it to /shares/{hash}/auth (an unauthenticated endpoint) to mint a JWT at the share's configured permission level (read-write or admin), bypassing their assigned read-only access. The vulnerability exists because the list endpoint correctly requires IsAdmin to view shares, but the single-read endpoint's gate was never aligned. Both v1 and v2 APIs are affected; patching requires restricting the hash field serialization or raising the permission check to IsAdmin.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-08-31: disclosed
- 2026-09-15: patched: version 2.6.0