EUVD-2026-78654

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts...