GHSA-3hc7-r24j-rpwc

Summary

Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks (?expand%5B%5D=subtasks). The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it returns the linked subtasks regardless of whether the caller has any access to the project they belong to. So a member with read-only access to one project can read the full content of tasks in other, private projects, any task that is a (recursive) subtask of a task the member is allowed to see.

Details

Subtasks can cross project boundaries; a task in an accessible project can be linked as the parent of a subtask that lives in a private project. Creating that link requires access to both tasks, so the link itself is set up legitimately by someone who has it. The problem is what happens afterwards, on read.

When a task list is requested with subtask expansion, the server takes the tasks the caller is allowed to see and walks their subtask relations recursively to fetch the linked tasks. That fetch doesn't apply the access-control filter the main listing use, it returns every linked task by ID, with no check on whether the caller can access the project it belongs to. Because the walk is recursive, it also returns the entire subtree beneath each linked task.

The effect is a cross-project read. A read-only member of project P who has no access at all to a private project Q can retrieve Q's tasks, full objects, including title, description, dates, assignees, labels, and attachment metadata, as long as some task in Q is linked as a subtask under a task in P. The links persist after access changes, so a former collaborator who has been removed from Q, but still has read access to P, keeps this read channel into Q.

The fix is to apply the same project-access filter to the expanded subtasks that the main listing already applies, so only subtasks in projects the caller can access are returned.

PoC

Setup: the attacker has read-only access to project P. A task in P has a subtask that lives in a private project Q the attacker cannot access (a normal cross-project subtask, created earlier by someone with access to both).

1. List P's tasks with subtask expansion:

GET /api/v1/projects/<P>/views/<view>/tasks?expand%5B%5D=subtasks

2. The response includes the task from Q as a full object, title, description, dates, assignees, labels, attachment metadata, even though the attacker has no access to Q. Because the expansion is recursive, the entire subtree of subtasks beneath it is returned too. The same works against the account-wide listing:

GET /api/v1/tasks?expand%5B%5D=subtasks

Impact

Cross-project confidentiality break. A user with read access to one project can read the full content of tasks in other projects they were never granted access to, whenever those tasks are linked as subtasks (directly or recursively) under a task they can see. The disclosure is read-only, no modification, but it exposes arbitrary private task data, and it survives access revocation, since the underlying links remain after a collaborator is removed. Exploitation depends on a suitable cross-project subtask link already existing; the attacker cannot create one to a project they can't access.

Summary

Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks (?expand%5B%5D=subtasks). The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it returns the linked subtasks regardless of whether the caller has any access to the project they belong to. So a member with read-only access to one project can read the full content of tasks in other, private projects, any task that is a (recursive) subtask of a task the member is allowed to see.

Details

Subtasks can cross project boundaries; a task in an accessible project can be linked as the parent of a subtask that lives in a private project. Creating that link requires access to both tasks, so the link itself is set up legitimately by someone who has it. The problem is what happens afterwards, on read.

When a task list is requested with subtask expansion, the server takes the tasks the caller is allowed to see and walks their subtask relations recursively to fetch the linked tasks. That fetch doesn't apply the access-control filter the main listing use, it returns every linked task by ID, with no check on whether the caller can access the project it belongs to. Because the walk is recursive, it also returns the entire subtree beneath each linked task.

The effect is a cross-project read. A read-only member of project P who has no access at all to a private project Q can retrieve Q's tasks, full objects, including title, description, dates, assignees, labels, and attachment metadata, as long as some task in Q is linked as a subtask under a task in P. The links persist after access changes, so a former collaborator who has been removed from Q, but still has read access to P, keeps this read channel into Q.

The fix is to apply the same project-access filter to the expanded subtasks that the main listing already applies, so only subtasks in projects the caller can access are returned.

PoC

Setup: the attacker has read-only access to project P. A task in P has a subtask that lives in a private project Q the attacker cannot access (a normal cross-project subtask, created earlier by someone with access to both).

1. List P's tasks with subtask expansion:

GET /api/v1/projects/<P>/views/<view>/tasks?expand%5B%5D=subtasks

2. The response includes the task from Q as a full object, title, description, dates, assignees, labels, attachment metadata, even though the attacker has no access to Q. Because the expansion is recursive, the entire subtree of subtasks beneath it is returned too. The same works against the account-wide listing:

GET /api/v1/tasks?expand%5B%5D=subtasks

Impact

Cross-project confidentiality break. A user with read access to one project can read the full content of tasks in other projects they were never granted access to, whenever those tasks are linked as subtasks (directly or recursively) under a task they can see. The disclosure is read-only, no modification, but it exposes arbitrary private task data, and it survives access revocation, since the underlying links remain after a collaborator is removed. Exploitation depends on a suitable cross-project subtask link already existing; the attacker cannot create one to a project they can't access.

Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.