Threats Tagged 'ghsa-3hc7-r24j-rpwc'
View all threats tagged with 'ghsa-3hc7-r24j-rpwc'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-3hc7-r24j-rpwc'
Click on any threat for detailed analysis and mitigation recommendations
Vikunja has a vulnerability where subtasks linked across projects are disclosed without proper access control. A user with read access to one project can retrieve full details of tasks in other private projects if those tasks are subtasks linked under accessible tasks. This cross-project disclosure exposes sensitive task data including titles, descriptions, dates, assignees, labels, and attachment metadata. The issue arises because subtask expansion does not enforce project access filtering. The vulnerability is read-only and depends on pre-existing cross-project subtask links. A fix is available to apply correct access filtering on expanded subtasks. Join the discussion | GCVE Database | 10/09/2026, 20:54:46 UTC Added: 10/09/2026, 22:44:15 UTC |
Showing 1 to 1 of 1 result