CVE-2026-56765: Vikunja Privilege Escalation Vulnerability

CVE-2026-56765 Overview

CVE-2026-56765 is an authorization flaw in Vikunja, an open-source task management platform, affecting all versions before 2.2.1. The vulnerability chains two distinct issues: the LinkSharing.ReadAll endpoint discloses share hashes to users holding only read access, and the GetTaskAttachment endpoint applies permission checks against user-supplied task IDs while retrieving attachments by sequential ID without ownership verification. Attackers exploiting this chain can escalate to admin-level shares and download or delete every file attachment across every project on the instance. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers with a valid share link can achieve instance-wide read and delete access to all task attachments across every project.

Affected Products

Vikunja versions prior to 2.2.1
Vikunja LinkSharing.ReadAll endpoint
Vikunja GetTaskAttachment endpoint

Discovery Timeline

2026-07-10 - CVE-2026-56765 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-56765

Vulnerability Analysis

The vulnerability combines two independent authorization defects into a single exploitable chain. The first defect resides in the LinkSharing.ReadAll endpoint. This endpoint returns full share metadata, including the secret share hash, to any authenticated user with read access on a project. Read-only users can obtain hashes bound to admin-privileged link shares and reuse them for elevated access.

The second defect resides in the GetTaskAttachment endpoint. The endpoint validates the caller's permissions against a task ID supplied in the request. However, the attachment itself is loaded by a separate sequential attachment ID that is never checked against the task or its parent project. An attacker who owns any task on the instance can iterate the attachment ID space and retrieve or delete attachments belonging to unrelated projects.

Root Cause

The root cause is inconsistent authorization scoping. The permission subject (task ID) and the resource being accessed (attachment ID) are decoupled in the handler. The share endpoint additionally treats hash values as non-sensitive metadata rather than credentials. Both defects map to CWE-639, where access control decisions rely on identifiers that the user can substitute freely.

Attack Vector

The attack is network-reachable and requires no user interaction. An attacker with any authenticated session, or a shared link with read access, enumerates share hashes via LinkSharing.ReadAll to acquire an admin-tier share. Using that access, the attacker calls GetTaskAttachment with a task they control and iterates the numeric attachment ID parameter. Each request returns or deletes an attachment tied to an unrelated project, resulting in full instance data exfiltration and destruction.

The vulnerability is described in the GitHub Security Advisory GHSA-2pv8-4c52-mf8j and the VulnCheck advisory.

Detection Methods for CVE-2026-56765

Indicators of Compromise

High-volume sequential requests to the GetTaskAttachment endpoint originating from a single account or share token.
Repeated calls to LinkSharing.ReadAll followed by authentication attempts using previously unseen share hashes.
Attachment DELETE operations that span multiple project IDs within a short time window.
Access to attachments by users who have no membership or share relationship with the parent project.

Detection Strategies

Enable application-level audit logging on Vikunja and correlate attachment access events against the caller's project membership.
Alert on any account that requests attachments belonging to more than a small threshold of distinct projects per hour.
Baseline normal share-hash usage and flag reuse of hashes from IP addresses that did not originate the share.

Monitoring Recommendations

Forward Vikunja access logs and reverse-proxy logs to a centralized SIEM for query and retention.
Monitor HTTP status distributions on /api/v1/tasks/*/attachments/* endpoints for anomalous 200-response bursts.
Track deletion operations on attachment resources and require review when volume exceeds baseline.

How to Mitigate CVE-2026-56765

Immediate Actions Required

Upgrade Vikunja to version 2.2.1 or later on all instances.
Rotate all existing link-sharing hashes after upgrade to invalidate any previously disclosed values.
Audit attachment access and deletion logs for the period preceding the upgrade to identify potential data exposure.
Restrict inbound network access to the Vikunja API to trusted networks where feasible.

Patch Information

The maintainers released a fix in Vikunja 2.2.1. The patch enforces ownership validation on GetTaskAttachment by scoping attachment retrieval to the authorized task and project, and it removes share hash values from responses returned by LinkSharing.ReadAll to non-admin users. Patch details are documented in the GitHub Security Advisory GHSA-2pv8-4c52-mf8j.

Workarounds

Disable link sharing at the instance level until the upgrade to 2.2.1 is complete.
Place Vikunja behind an authenticating reverse proxy to prevent unauthenticated share-hash enumeration.
Temporarily revoke shared links that grant admin-level permissions on sensitive projects.

bash

# Upgrade example using Docker Compose
docker compose pull vikunja
docker compose up -d vikunja
docker exec vikunja /app/vikunja/vikunja version