Threats tagged 'ghsa-h94h-5hrj-rqqg'

Vikunja versions from 0.23.0 up to but not including 2.7.1 have an information disclosure vulnerability. Project collaborators with write access can exploit this flaw by registering webhooks to read tasks from projects they should not access. The webhook payloads are generated with the permissions of the user triggering the event, allowing attackers to obtain titles, descriptions, and metadata of tasks from private projects when linked tasks are modified.