Api: Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

The Vikunja API's task relation deletion endpoint does not check if the caller has read access to the related task before allowing deletion. While relation creation requires both write access on the base task and read access on the other task, deletion only requires write access on the base task. Consequently, an attacker with write permission on one project can delete relations involving tasks in inaccessible projects, causing the relation to be removed from both ends. This affects the DELETE /api/v1/tasks/{id}/relations/{kind}/{otherTaskId} endpoint and its v2 equivalent. The vulnerability was confirmed in version 2.5.0 and affects versions >=0.9 and <2.6.0.

The impact is limited to integrity: an authenticated user with write access to a project can remove task relations that link to tasks in projects they cannot read. No data disclosure or privilege escalation occurs, and the attacker cannot recreate the deleted relation. The other project's users see the relation disappear without indication of who removed it.

A patch is available that updates the deletion authorization to require read access on the related task in addition to write access on the base task, mirroring the creation permission checks. Users should upgrade to a fixed version >=2.6.0 when available. Until then, restrict write permissions carefully to trusted users. Patch status is confirmed as available.