{"answers":{"affected":"3 open source packages ship an affected version, including code.vikunja.io/api.","exploited":"There is no known exploitation of GHSA-3hc7-r24j-rpwc in the wild and no public exploit code.","fix":"Upgrade code.vikunja.io/api to 2.6.0 or later.","what":"GHSA-3hc7-r24j-rpwc is a missing authorization vulnerability in code.vikunja.io/api, published on 9 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-3hc7-r24j-rpwc and fix it if it is affected.\n\nWhat it is: GHSA-3hc7-r24j-rpwc is a missing authorization vulnerability in code.vikunja.io/api, published on 9 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-3hc7-r24j-rpwc in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- code.vikunja.io/api (Go): affected all versions; no fix listed\n- code.vikunja.io/api (Go): affected all versions; fixed in 2.6.0\n- code.vikunja.io/api (Go): affected all versions; fixed in 2.6.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-3hc7-r24j-rpwc/ (Markdown: https://insights.sbomify.com/GHSA-3hc7-r24j-rpwc/index.md)","id":"GHSA-3hc7-r24j-rpwc","markdown":"https://insights.sbomify.com/GHSA-3hc7-r24j-rpwc/index.md","name":"GHSA-3hc7-r24j-rpwc","record":{"aliases":["GO-2026-6714"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Vikunja task manager","requires_auth":"low_privilege","summary":"Authenticated users can read private tasks in other projects via subtask expansion due to missing access control checks.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nVikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks (?expand%5B%5D=subtasks). The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it returns the linked subtasks regardless of whether the caller has any access to the project they belong to. So a member with read-only access to one project can read the full content of tasks in other, private projects, any task that is a (recursive) subtask of a task the member is allowed to see.\n\n### Details\nSubtasks can cross project boundaries; a task in an accessible project can be linked as the parent of a subtask that lives in a private project. Creating that link requires access to both tasks, so the link itself is set up legitimately by someone who has it. The problem is what happens afterwards, on read.\n\nWhen a task list is requested with subtask expansion, the server takes the tasks the caller is allowed to see and walks their subtask relations recursively to fetch the linked tasks. That fetch doesn't apply the access-control filter the main listing use,  it returns every linked task by ID, with no check on whether the caller can access the project it belongs to. Because the walk is recursive, it also returns the entire subtree beneath each linked task.\n\nThe effect is a cross-project read. A read-only member of project P who has no access at all to a private project Q can retrieve Q's tasks, full objects, including title, description, dates, assignees, labels, and attachment metadata, as long as some task in Q is linked as a subtask under a task in P. The links persist after access changes, so a former collaborator who has been removed from Q, but still has read access to P, keeps this read channel into Q.\n\nThe fix is to apply the same project-access filter to the expanded subtasks that the main listing already applies, so only subtasks in projects the caller can access are returned.\n\n### PoC\nSetup: the attacker has read-only access to project P. A task in P has a subtask that lives in a private project Q the attacker cannot access (a normal cross-project subtask, created earlier by someone with access to both).\n\n1. List P's tasks with subtask expansion:\n```\nGET /api/v1/projects/\u003cP\u003e/views/\u003cview\u003e/tasks?expand%5B%5D=subtasks\n```\n2. The response includes the task from Q as a full object, title, description, dates, assignees, labels, attachment metadata, even though the attacker has no access to Q. Because the expansion is recursive, the entire subtree of subtasks beneath it is returned too.\nThe same works against the account-wide listing:\n```\nGET /api/v1/tasks?expand%5B%5D=subtasks\n```\n### Impact\nCross-project confidentiality break. A user with read access to one project can read the full content of tasks in other projects they were never granted access to, whenever those tasks are linked as subtasks (directly or recursively) under a task they can see. The disclosure is read-only, no modification, but it exposes arbitrary private task data, and it survives access revocation, since the underlying links remain after a collaborator is removed. Exploitation depends on a suitable cross-project subtask link already existing; the attacker cannot create one to a project they can't access.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Vikunja: Cross-project task disclosure through subtask expansion","id":"GHSA-3hc7-r24j-rpwc","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api","source":"GO-2026-6714"},{"ecosystem":"Go","fixed":["2.6.0"],"introduced":["0"],"last_affected":[],"package":"code.vikunja.io/api","purl":null,"source":"GHSA-3hc7-r24j-rpwc"},{"ecosystem":"Go","fixed":["2.6.0"],"introduced":["0"],"last_affected":[],"package":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api","source":"GHSA-3hc7-r24j-rpwc"}],"products":null,"published":"2026-10-09","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can read private tasks in other projects via subtask expansion due to missing access control checks.","url":"https://insights.sbomify.com/GHSA-3hc7-r24j-rpwc/"}