The vulnerability in Vikunja prior to version 2.2.1 involves two main issues: first, the LinkSharing.ReadAll endpoint leaks share hashes to users who only have read access, which can be exploited to escalate permissions to admin-level shares. Second, the GetTaskAttachment endpoint inadequately verifies permissions by checking user access against task IDs but fetching attachments by sequential IDs without ownership validation. This allows an attacker to access and delete any file attachment across all projects on the instance, representing a critical authorization and access control flaw.

An attacker with read access can escalate privileges to admin-level shares by exploiting the exposure of share hashes. Furthermore, the attacker can download and delete all file attachments across all projects on the Vikunja instance, potentially leading to data loss and unauthorized data access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user access to trusted users only and monitor for suspicious activity related to share hashes and attachment access. Avoid exposing the vulnerable endpoints to untrusted users.