CyberRota Analysis
AI-GeneratedVikunja versions prior to 2.6.0 are vulnerable to an API token scope bypass in task read endpoints, allowing attackers with limited token scopes to exploit the expand parameter and access unauthorized data, including comments, reactions, and time entries. This vulnerability poses a medium severity risk as it compromises data confidentiality. Organizations using Vikunja should prioritize updating to version 2.6.0 or later to mitigate potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.