Principal-Type Confusion

code.vikunja.io/api is vulnerable to a principal-type confusion. The vulnerability is due to missing type validation in permission checks, which allows an attacker with a link-sharing JWT to exploit ID collisions to remove victims from teams, enumerate and delete their bot users, or access team...