Vikunja, an open‑source task management platform, has an IDOR that permits any authenticated user to read comments for tasks they are not authorized to see. The flaw arises because the comment API requires only a task ID, allowing attackers to substitute the ID of a task they normally can access and bypass the task‑level permission check. The weakness is classified as CWE‑639, and the impact is a confidentiality breach of comment content without affecting integrity or availability.

All instances of Vikunja running versions prior to 2.2.0 are affected. The product is developed by go‑vikunja under the vendor name Vikunja. Version 2.2.0 and later contain a patch, so only deployments using v2.1.x or earlier are vulnerable.

The CVSS base score of 5.3 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. No EPSS data is available. Exploitation requires simply being authenticated to the system; no elevated privileges are needed. An attacker who can log in can enumerate comment content across tasks, potentially exposing sensitive operational information.