3 matches found
GHSA-3HC7-R24J-RPWC Vikunja: Cross-project task disclosure through subtask expansion
Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...
GHSA-72H8-WP98-7HCH Unleash: Missing await on permission check + cross-project IDOR in admin API
Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...
