Vikunja versions prior to 2.7.1 archive data dumps with world‑readable permissions. The vulnerability allows a local user on a shared host to read these zip archives and obtain configuration files, password hashes, TOTP secrets, tokens, and stored files. The flaw originates from improper file permission handling (CWE‑276) and enables data exposure without authentication or exposure to the network.

The affected product is Vikunja (go‑vikunja:vikunja) and any deployment running a version earlier than 2.7.1. No specific minor versions were listed, so all releases below 2.7.1 are considered vulnerable.

The CVSS score of 6.9 indicates medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently widely exploited. The attack vector is local: an attacker who can run commands on the same host can read the world‑readable dump file and retrieve sensitive data. Because the data can contain credentials and secrets, the impact on confidentiality could be critical if the attacker gains access to database dumps or configuration values. The risk is elevated on multi‑tenant or shared hosting environments where unprivileged users have access to the filesystem.