EUVD-2026-277695

fkie_cve-2026-33680

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.

GHSA-8hp8-9fhr-pfm9 — Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

Affected: Go: code.vikunja.io/api

## Summary

The `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access.

## Details

The vulnerability arises from an inconsistency between the `ReadOneWeb` and `ReadAllWeb` generic handlers and the `LinkSharing` permission model.

**`LinkSharing.CanRead()` correctly blocks link share users** (`pkg/models/link_sharing_permissions.go:25-29`): ```go func (share *LinkSharing) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) { if _, is := a.(*LinkSharing); is { return false, 0, nil // Blocks link share users } // ... } ```

**`ReadOneWeb` calls `CanRead()` before returning data** (`pkg/web/handler/read_one.go:64`): ```go canRead, maxPermission, err := currentStruct.CanRead(s, currentAuth) if !canRead { return echo.NewHTTPError(http.StatusForbidden, ...) } ```

**`ReadAllWeb` does NOT call `CanRead()`** (`pkg/web/handler/read_all.go:106`): ```go // Directly calls ReadAll without permission check result, resultCount, numberOfItems, err := currentStruct.ReadAll(s, currentAuth, search, pageNumber, perPageNumber) ```

**`LinkSharing.Re…

Most recent entries from all

EUVD-2026-277695

fkie_cve-2026-33680

GHSA-8hp8-9fhr-pfm9 — Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation