https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:43:16.069717+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277216 EUVD-2026-277216 2026-10-07T07:43:16.073538+00:00 EUVD-2026-277216 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33678 fkie_cve-2026-33678 2026-10-07T07:43:16.073580+00:00

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial. Version 2.2.1 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-jfmm-mjcp-8wq2 GHSA-jfmm-mjcp-8wq2 — Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion 2026-10-07T07:43:16.073617+00:00

Affected: Go: code.vikunja.io/api

## Summary

`TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial.

## Details

The vulnerability is in `pkg/models/task_attachment.go` in the `ReadOne` method:

```go // pkg/models/task_attachment.go:110-120 func (ta *TaskAttachment) ReadOne(s *xorm.Session, _ web.Auth) (err error) { exists, err := s.Where("id = ?", ta.ID).Get(ta) // Only checks attachment ID, ignores TaskID if err != nil { return } if !exists { return ErrTaskAttachmentDoesNotExist{ TaskID: ta.TaskID, AttachmentID: ta.ID, } } // ... } ```

The permission check in `pkg/models/task_attachment_permissions.go` validates access to the URL task, not the attachment's actual task:

```go // pkg/models/task_attachment_permissions.go:25-28 func (ta *TaskAttachment) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) { t := &Task{ID: ta.TaskID} // ta.TaskID is from URL param :task return t.CanRead(s, a) } ```

The `TaskAttachment` struct binds URL parameters via struct tags (`param:"task"` and `param:"attachment"`): ```go // pkg/mo…