Api: Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

The Vikunja CalDAV API's task relation creation functionality bypasses the TaskRelation.CanCreate permission check enforced by the REST API. Specifically, the CalDAV handler uses an unscoped UID lookup to identify related tasks and directly creates relations without verifying if the user has permission to create them. Since task UIDs are exposed to anyone who had read access to the project via CalDAV, an attacker who knows a task's UID can attach a relation to that task, even if they no longer have access to the project containing it. This unauthorized write capability allows attackers to create subtask or parent relations across projects, violating access controls and enabling further cross-project disclosure issues. The vulnerability was verified in Vikunja version 2.5.0 and affects all versions prior to 2.6.0. The recommended fix is to enforce permission checks on CalDAV relation creation and restrict UID lookups to projects accessible by the caller.

This vulnerability results in broken access control allowing unauthorized users to write task relations to any task by UID, including tasks in projects they do not have access to. Attackers can create subtask or parent relations arbitrarily, potentially polluting task relations and enabling cross-project disclosure issues. While reading the related task's contents still requires separate disclosure vulnerabilities, this flaw enables unauthorized write operations that violate project boundaries and data integrity.

A patch is available that fixes this vulnerability by routing CalDAV relation creation through the TaskRelation.CanCreate permission check and scoping UID lookups to projects accessible by the caller. Users should upgrade to Vikunja version 2.6.0 or later to remediate this issue. Until patched, users should consider restricting CalDAV access to trusted users only, especially those who previously had project read access.