GHSA-39P5-2WRR-XH29 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

Summary Vikunja's web.Auth interface pkg/web/web.go, single method GetID int64 is satisfied by BOTH user.User and models.LinkSharing. A link-share's GetID returns the raw positive share.ID pkg/models/linksharing.go:83-85, which lives in the same positive autoincrement ID space as users.id. The sa...

CVE-2026-104962 Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-32r8-5843-4qw2. This link is maintained to preserve external references. Original Description Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are...