Threats tagged 'ghsa-x356-gv6g-6mff'

Vikunja versions prior to 2.7.1 have an authorization bypass vulnerability that enables authenticated users to read any task. This is achieved by injecting a crafted task object during a no-op Kanban bucket move, allowing attackers to access task details they should not have permission to view.