Access Control Flaw in Vikunja Task Management Platform

CVE-2026-33680

What is CVE-2026-33680?

Vikunja, an open-source self-hosted task management platform, has a vulnerability that affects versions prior to 2.2.2. The LinkSharing.ReadAll() method permits authenticated link share users to enumerate all link shares associated with a project, exposing their secret hashes. While the LinkSharing.CanRead() function appropriately restricts access in other contexts, the ReadAllWeb handler inadvertently circumvents this security check, allowing an attacker possessing a read-only link share to gain access to hashes for more privileged link shares on the same project. This unauthorized disclosure can enable the attacker to authenticate as an admin, escalating their access privileges. The issue has been resolved in version 2.2.2.

References