PT-2026-31947

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.3.0 Description A SQL operator precedence bug exists in the hasAccessToLabel function. This allows any authenticated user to read any label that has at least one task association, regardless of project access. Expos...