{"items":[{"id":"NVI-00012052","kind":"vulnerability","title":"Vikunja: Cross-project task disclosure through subtask expansion","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3hc7-r24j-rpwc"],"plain_summary":"GitHub lists this reviewed advisory for code.vikunja.io/api. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-966b749b1f3a32fe3147f00ef1a0edf6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-966b749b1f3a32fe3147f00ef1a0edf6","url":"https://github.com/advisories/GHSA-3hc7-r24j-rpwc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3hc7-r24j-rpwc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:22.124Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-966b749b1f3a32fe3147f00ef1a0edf6"],"technology":"code.vikunja.io/api","known_exclusions":[],"conditions_summary":"### Summary\nVikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks (?expand%5B%5D=subtasks). The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it returns the linked subtasks regardless of whether the caller has any access to the project they belong to. So a member with read-only access to one project can read the full content of tasks in other, private projects, any task that is a (recursive) subtask of a task the member is allowed to see.\n\n### Details\nSubtasks can cross project boundaries; a task in an accessible project can be linked as the parent of a subtask that lives in a private project. Creating that link requires access to both tasks, so the link itself is set up legitimately by someone who has it. The problem is what happens afterwards, on read.\n\nWhen a task list is requested with subtask expansion, the server takes the tasks the caller is allowed to see and walks their subtask relations recursively to fetch the linked tasks. That fetch doesn't apply the access-control filter the main listing use,  it returns every l","public_affected_ranges":["<= 2.5.0"]}],"null_published_at":"2026-11-01T01:03:56.626Z","source_updated_at":"2026-10-09T20:54:47.000Z","source_disclosed_at":"2026-10-09T20:54:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:22.124Z"}],"next_cursor":null,"snapshot_revision":"42594"}