PT-2026-92095 · Vikunja · Vikunja
CVSS v4.0
5.3
متوسطة
| المتجه | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Vikunja versions prior to 2.6.0
Description
Improper validation of link-share tokens in the v2 API user search endpoints allows attackers possessing a read-only share link to enumerate project users through the 'projects' endpoint and verify the existence of arbitrary usernames via the global search endpoint.
Recommendations
Update to version 2.6.0 or later.
استغلال
إصلاح
Information Disclosure
Incorrect Authorization
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Vikunja