The flaw arises from an authorization oversight in Vikunja versions before 2.2.1. The LinkSharing.ReadAll endpoint exposes shared link hashes to any user with read access; these hashes can include admin-level links, enabling a low‑privilege or unauthenticated user to gain higher privileges. In addition, the GetTaskAttachment endpoint performs a permission check only against the supplied task ID but retrieves attachments by a sequential numeric ID without confirming that the attachment belongs to the requested task or project. This creates an in line with CWE-639.

All installations of Vikunja running a version before 2.2.1 are affected; the vulnerability exists in the core product regardless of configuration and applies to every official release and community distribution before the 2.2.1 update.

The CVSS score of 9.3 marks this as Critical. The EPSS score of < 1% indicates a very low exploitation likelihood; it is inferred that while the probability of exploitation is low, the attack path is simple once the vulnerability is discovered. The vulnerability is not listed in the CISA KEV catalog, but the combination of exposed identifiers and a concurrent IDOR creates a clear attack vector for attackers seeking widespread data breach or deletion.