Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
•added 2026/10/09 8:54 p.m.•4 views

Vikunja: Cross-project task disclosure through subtask expansion

Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...

5.7AI score
SaveExploits0References5Affected Software1
Rows per page
Query Builder