PT-2026-92094 · Vikunja · Vikunja
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
vikunja versions prior to 2.6.0
Description
Authenticated users can enumerate all teams and members because the software fails to validate team access when attaching teams to projects. By sending arbitrary team IDs to the project teams endpoint, an attacker can retrieve complete team rosters, including member names and admin flags for teams they are not authorized to access.
Recommendations
Update vikunja to version 2.6.0 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vikunja