CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

3 matches found

OSV•added 2026/03/26 4:56 p.m.•0 views

GHSA-2PV8-4C52-MF8J Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

Summary Two independently-exploitable authorization flaws in Vikunja can be chained to allow an unauthenticated attacker to download and delete every file attachment across all projects in a Vikunja instance. The ReadAll endpoint for link shares exposes share hashes including admin-level shares t...

9.1CVSS5.9AI score

Exploits0References5