Threats tagged 'ghsa-4qv2-8cxq-cg82'

Vikunja versions from 0.18.0 up to but not including 2.7.1 contain a privilege escalation vulnerability. This flaw allows team owners to escalate their privileges to admin or ownership of read-only shared projects by exploiting account deletion functionality. Specifically, attackers can create a bot, add it to their team, and then delete it via the bots endpoint, which triggers a function that improperly promotes read-only shares and locks out the legitimate owner.