CVE-2026-33678

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, "TaskAttachment.ReadOne" queries attachments by ID only "WHERE id = ?", ignoring the task ID from the URL path. The permission check in "CanRead" validates access to the task specified in the URL, but "ReadOne...

CVE-2026-33678: Authorization Bypass Through User-Controlled Key

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, TaskAttachment.ReadOne queries attachments by ID only WHERE id = ?, ignoring the task ID from the URL path. The permission check in CanRead validates access to the task specified in the URL, but ReadOne loads ...