0Xcelien

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Authenticated users can cause a denial of service during data import because the system fails to limit archive expansion. An attacker can upload highly compressed files that expand to tens of gigabytes in memory and on disk, which exhausts server resources and crashes the instance. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** vikunja versions prior to 2.6.0 **Description** Authenticated users can enumerate all teams and members because the software fails to validate team access when attaching teams to projects. By sending arbitrary team IDs to the project teams endpoint, an attacker can retrieve complete team rosters, including member names and admin flags for teams they are not authorized to access. **Recommendations** Update vikunja to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Improper validation of link-share tokens in the v2 API user search endpoints allows attackers possessing a read-only share link to enumerate project users through the 'projects' endpoint and verify the existence of arbitrary usernames via the global search endpoint. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** The software exposes the raw Time-based One-Time Password (TOTP) shared secret after enrollment. This occurs through the 'GET /api/v1/user/settings/totp' and 'GET /api/v1/user/settings/totp/qrcode' endpoints without requiring re-authentication. An attacker possessing a valid access token can retrieve this secret and import it into an authenticator app to generate valid codes indefinitely, bypassing the second factor authentication and enabling account takeover. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.6.0 **Description** Insufficient access restriction to the link-share hash field in single-share read endpoints allows read-only members to obtain the secret credential of a share. An attacker can use this disclosed hash to obtain a link-share JWT (JSON Web Token), which is a compact, URL-safe means of representing claims to be transferred between two parties. This allows the attacker to escalate privileges and perform unauthorized administrative actions or writes. **Recommendations** Update to version 2.6.0 or later.