Vikunja versions prior to 2.7.1 contain an insecure file permissions flaw that allows any local user to read blobs created by localStorage.Write, making them world‑readable. Attackers can therefore obtain attachments, project background images, exported data, and the entire SQLite database. The exposed database can be copied and used to crack password hashes offline, leading to potential credential compromise. This vulnerability is classified as CWE‑276, reflecting insecure access control via improperly set file permissions.

The affected product is Vikunja developed by go‑vikunja, specifically all releases before version 2.7.1. Users running these versions on shared hosting environments are at risk, while newer releases (2.7.1 and later) are not affected.

The CVSS score of 6.8 indicates moderate severity. Circuitous exploitation requires local access; no remote component is involved. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation activity. Local attackers on a shared host can easily read the exposed files, but the impact is confined to the host itself rather than spanning remote systems. The risk depends heavily on the isolation controls in place on the host.