Api: Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Vikunja before version 2.6.0 improperly restricts access to the link-share hash field in single-share read endpoints of its API. Read-only project members can retrieve the share's secret access hash, which can then be exchanged for a link-share JWT token at the share's permission level. This allows attackers to escalate privileges beyond read-only access, enabling unauthorized write or administrative operations on the share. The vulnerability is tracked under CWE-200 (Exposure of Sensitive Information).

An attacker with read-only membership in a project can obtain the secret link-share hash, which is intended to be confidential. Using this hash, the attacker can escalate their permissions to the share's full permission level, potentially performing unauthorized modifications or administrative actions. This compromises the confidentiality and integrity of the shared resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the advisory is a duplicate and withdrawn, refer to the original advisory GHSA-qfwc-vx6f-3g6g for official remediation information. Users should upgrade to Vikunja version 2.6.0 or later once a fix is confirmed available.