Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...

GHSA-2922-QGFJ-PR7V Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-39p5-2wrr-xh29. This link is maintained to preserve external references. Original Description vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to...