Threats tagged 'ghsa-526f-fc44-8pmq'

Vikunja versions prior to 2.7.1 have an information exposure vulnerability where the request logger records the raw URI of the /shares/:share/auth route. This logging behavior exposes link-share hashes in logs accessible to attackers with access to Vikunja or reverse proxy logs. These hashes are non-expiring and not password-protected, allowing attackers to reuse them to obtain project JWTs with read, write, or admin permissions.