CVE-2026-33678 - Vulnerability Analysis

Overview

Vikunja < 2.2.1 contains a broken access control caused by TaskAttachment.ReadOne() querying attachments by ID without validating task ID, letting authenticated users download or delete any attachment, exploit requires authentication.

Severity & Score

Impact

Authenticated users can access or delete attachments from other projects, leading to unauthorized data access and modification.

Mitigation

Update to version 2.2.1 or later.

References

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-jfmm-mjcp-8wq2
• https://vikunja.io/changelog/vikunja-v2.2.2-was-released

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner