Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

Vulnerability

CVE-2026-33678 is an insecure direct object reference (IDOR) flaw in Vikunja, an open-source task management platform. The TaskAttachment.ReadOne() method queries attachments solely by attachment ID (WHERE id = ?), ignoring the associated task ID from the URL path [1][2]. The CanRead() permission check evaluates the task ID present in the URL, but ReadOne() then loads a different attachment if the attachment ID does not belong to that task [2]. This mismatch means the system validates access to the user's own task but fetches an arbitrary attachment.

Exploitation

Both read and delete operations are affected. For a GET request, the handler calls CanRead (which checks the URL task) and then ReadOne, which loads any attachment by its ID [2]. For DELETE, the handler uses CanDelete (again checking access to the URL task) and then Delete, which internally calls ReadOne to load the attachment before removing it [2]. Attachment IDs are sequential integers, making them easy to enumerate [1]. An authenticated user can supply any attachment ID (e.g., /api/v1/tasks/OWN_TASK_ID/attachments/TARGET_ATTACHMENT_ID) to read or delete attachments belonging to other users' projects.

Impact

This vulnerability allows any authenticated user to download or delete any file attachment stored in the Vikunja instance, regardless of project ownership [1][2]. An attacker who can access one task—even one they created—can pivot to read or destroy attachments from any other task in the system. The same flaw was previously fixed for task comments, suggesting a recurring pattern in the codebase [2].

Mitigation

The vulnerability is patched in Vikunja version 2.2.1 [1][3]. The patch adds a check to ensure the attachment ID belongs to the specified task before performing the read or delete operation. Users are strongly advised to update immediately, as this bug was part of a chain (with CVE-2026-33680) that could enable full administrative access [3].