Vikunja versions before 2.7.1 log the full request path for the /shares/:share/auth endpoint. This includes the unencoded share hash, exposing the hash to anyone who can read the logs. The exposed hash can be reused to obtain a project JWT with read, write, or admin permissions because the shares are non‑expiring and need no password. The hacker could therefore gain persistent access to sensitive data, modify or delete content, or perform administrative actions on the project. The weakness is catalogued as CWE‑532 and represents an information‑exposure flaw.

All installations of Vikunja prior to 2.7.1 are affected. The product is the open‑source task‑management platform Vikunja developed by the go‑vikunja community. No additional versions are listed, so any deployment using a release older than 2.7.1 should be considered vulnerable.

The CVSS score of 6.9 reflects the medium severity of the issue. The EPSS score is not available, but the lack of an immediate public exploit and absence from the CISA KEV catalog suggest a moderate likelihood of exploitation. The flaw can be exploited by anyone who can read the web server or reverse proxy logs, which may be considered a local or lateral attack vector. Attackers do not need elevated privileges to use the exposed hash; once they locate it in the logs, they can apply it to the application’s share endpoint and receive a fully‑privileged JWT. The consequence is a full compromise of the shared project, with potential escalation to broader system access if the JWT infiltrates other services.