Api: Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

The vulnerability exists in Vikunja's task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks) where the requested project view is loaded from the URL path without verifying the caller's authorization. While the task scope is limited to the share's own project for link-share token holders, the view parameter is attacker-controlled and not re-validated. This allows unauthorized reading of any tenant's kanban bucket records, including bucket titles and full created_by user objects (username, name, id) for every view in the instance. Additionally, the missing pre-authorization check creates a project/view-ID existence oracle via differing HTTP responses. Task contents themselves remain protected and are not disclosed. The vulnerability is fixed in Vikunja version 2.4.0.

An attacker with a link-share token can enumerate and read kanban bucket metadata and user information across all tenants in the Vikunja instance, violating tenant data isolation. This exposure includes sensitive user identifiers but does not disclose task content. The existence oracle can aid attackers in mapping valid project/view IDs. This impacts confidentiality but not integrity or availability.

Upgrade Vikunja to version 2.4.0 or later where this broken object level authorization vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in 2.4.0.