Vikunja’s CalDAV GetResource and GetResourcesByList methods fetch tasks by UID without verifying that the authenticated user has permission on the task’s project. As a result, any authenticated CalDAV user who knows or guesses a task UID can read the full task data from any project on the instance. This class of vulnerability is an authorization bypass that permits disclosure of confidential task information, but it does not provide remote code execution or other higher‑level privileges.

All instances of the Vikunja open‑source task management platform running a version earlier than 2.3.0 are vulnerable. The issue pertains to the CalDAV interface exposed by the Vikunja service and affects any deployment that accepts authenticated CalDAV connections.

The CVSS score of 4.3 indicates moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation currently known. Exploitation requires only an authenticated CalDAV client and a valid or guessed task UID, making the attack path simple for an insider or compromised user but not for unauthenticated external actors.