CVE-2026-56765

Critical

Description

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches attachments by sequential ID without verifying ownership, allowing attackers to download and delete all file attachments across all projects instance-wide.

SeverityCritical

CVSS9.8

Exploit probability—

ProductCode.vikunja.io/api

PublishedJul 10, 2026

First seenJul 10, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

code.vikunja.io/api2.2.1 or later

Vendor advisories

github.com/go-vikunja/vikunja/security/advisories/GHSA-2pv8-4c52-mf8j

Affected products

Product	Affected versions	Fixed in
code.vikunja.io/apiGo	v < 2.2.1, No range specified	2.2.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.