Vikunja’s TaskAttachment.ReadOne endpoint retrieves an attachment solely by ID, ignoring the task ID in the request path. Because the permission check enforces access only to the task specified in the URL, an attacker can supply any accessible task ID and an arbitrary attachment ID. This causes the system to load an attachment that may belong to a different project, enabling authenticated users to download or delete files that they should not have access to. The weakness is a form of Insecure Direct Object Reference (CWE‑639).

The flaw affects installations of the Vikunja task‑management platform prior to version 2.2.1. Vulnerable applications include the open‑source self‑hosted system at the cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* range. Any instance running an affected software version is susceptible, regardless of deployment size.

The CVSS base score of 8.1 indicates a high‑severity vulnerability. EPSS is under 1%, suggesting that exploitation density is currently low, and the issue is not listed in CISA’s KEV catalog. Nonetheless, the use of sequential numeric IDs makes attachment enumeration trivial, and any authenticated user can construct a request that deletes or downloads any file in the system. Attackers must first authenticate to the Vikunja instance, but no special privileges are required beyond valid credentials.