Vikunja’s delete endpoint for link shares does not verify that the share belongs to the project in the URL, creating an improper access control flaw. An attacker who has administrative privileges on any project can supply a different project identifier and a valid share identifier to remove link shares from projects they do not own. The result is an unauthorized deletion of shared links, which can disrupt collaborative workflows and potentially expose shared resources by removing access. The vulnerability does not provide direct code execution but impacts the integrity and availability of cross‑project link shares.

Open‑source task management platform Vikunja, developed by go‑vikunja. Versions prior to 2.2.1 are affected, as the patch is included in 2.2.1 and later releases.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% shows a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation requires authenticated admin access to any project, after which an attacker crafts a DELETE request with a target share ID and an arbitrary project ID to delete cross‑project shares. No additional conditions or payloads are required beyond valid authentication and the share ID target.