A missing authorization check in the Vikunja API allows an authenticated user who can read a task that has cross‑project relations to receive full details of related tasks in projects they are not authorized to view. The returned data includes title, description, due dates, priority, percent completion, and project identifier, permitting an attacker to learn confidential task information beyond their permitted scope. The weakness aligns with CWE‑863, unauthorized access to resources due to insufficient authorization checks.

The vulnerability affects the Vikunja task‑management platform distributed by go‑vikunja. Versions released before 2.2.1 are impacted; the issue is fixed in version 2.2.1 and later releases such as 2.2.2. Administrators should verify that their deployments are upgraded to at least 2.2.1.

The Common Vulnerability Scoring System rate of 6.5 indicates a moderate severity. The Exploit Prediction Scoring System shows a very low probability of exploitation (under 1 %). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the user to be authenticated and to possess read access to at least one task with cross‑project relations; the attacker then issues a standard API call to retrieve task information, exposing data from otherwise inaccessible projects.