CVE-2026-33678

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, "TaskAttachment.ReadOne" queries attachments by ID only "WHERE id = ?", ignoring the task ID from the URL path. The permission check in "CanRead" validates access to the task specified in the URL, but "ReadOne...