What’s Vulnerable › Vulnerabilities

CVE-2026-56765: Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-10 · updated 2026-07-10
• Weakness: CWE-639

Description

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches attachments by sequential ID without verifying ownership, allowing attackers to download and delete all file attachments across all projects instance-wide.

Affected products

• go-vikunja vikunja: before 2.2.1 — fixed in 2.2.1

How to fix

Upgrade to a fixed version: go-vikunja vikunja 2.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2pv8-4c52-mf8j
• https://www.vulncheck.com/advisories/vikunja-unauthenticated-instance-wide-data-breach-via-link-share-hash-disclosure-chained-with-cross-project-attachment-idor
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2pv8-4c52-mf8j

Get alerted when CVE-2026-56765 or the next vulnerability affects your stack