EUVD-2026-291186

fkie_cve-2026-35598

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance. This vulnerability is fixed in 2.3.0.

GHSA-48ch-p4gq-x46x — Vikunja Missing Authorization on CalDAV Task Read

Affected: Go: code.vikunja.io/api

## Summary

The CalDAV `GetResource` and `GetResourcesByList` methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows (or guesses) a task UID can read the full task data from any project on the instance.

## Details

`GetTasksByUIDs` at `pkg/models/tasks.go:376-393` performs a global database query with no authorization check:

```go func GetTasksByUIDs(s *xorm.Session, uids []string, a web.Auth) (tasks []*Task, err error) { tasks = []*Task{} err = s.In("uid", uids).Find(&tasks) // ... } ```

The `web.Auth` parameter is accepted but never used for permission filtering. This function is called by: - `GetResource` at `pkg/routes/caldav/listStorageProvider.go:266` (CalDAV GET) - `GetResourcesByList` at `pkg/routes/caldav/listStorageProvider.go:199` (CalDAV REPORT multiget)

All other CalDAV operations enforce authorization: `CreateResource` checks `CanCreate()`, `UpdateResource` checks `CanUpdate()`, `DeleteResource` checks `CanDelete()`. Only the read operations skip authorization.

The project ID in the CalDAV URL is ignored. A request to `/dav/projects/{attacker_project}/{victim_task_uid}.ics` returns the victim's task regardless of which project ID is in the path.

## Proof of Concept

Tested on Vikunja v2.2.2.

```python import requests from requests.auth import HTTPBasicAuth

TARGET = "http://localhost:3456" API = f"{TARGET}/api/v1"

def login(u, p):…

Most recent entries from all

EUVD-2026-291186

fkie_cve-2026-35598

GHSA-48ch-p4gq-x46x — Vikunja Missing Authorization on CalDAV Task Read