Api: Vikunja: Cross-project task disclosure through subtask expansion

Vikunja allows tasks in one project to have subtasks in different projects. When listing tasks with the subtask expansion option, the main task list is filtered by project access, but the recursive subtask expansion returns all linked subtasks regardless of access rights. This leads to unauthorized disclosure of full task details from private projects to users who only have read access to other projects. The vulnerability persists even after access revocation because the subtask links remain. The recommended fix is to apply the same project access filtering to subtasks during expansion as is done for the main task listing.

This vulnerability causes a confidentiality breach by exposing private task data across project boundaries. Users with read access to one project can read full details of tasks in other private projects if those tasks are linked as subtasks. The disclosure includes sensitive information such as task titles, descriptions, dates, assignees, labels, and attachment metadata. The issue is read-only and does not allow modification of data. The exposure can persist after access revocation due to lingering subtask links.

A patch is available for this vulnerability. The vendor should be consulted for the official fix to ensure that project access filtering is applied to subtask expansions. Until patched, users should be cautious about cross-project subtask links, as these enable unauthorized data disclosure. There is no indication that the vulnerability is mitigated or requires no action; applying the official fix is necessary.