Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-vfxw-3x8p-2vjr
code.vikunja.io/apiSummary
A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share link can list every member of the shared project (and its parent projects), and can test whether any username exists anywhere on the instance.
Details
Two endpoints are affected:
GET /api/v2/projects/{id}/users/search only checks project.CanRead, which a link share satisfies on its own project. With no parameter it returns the full user list, walking up the parent-project chain.
GET /api/v2/users?q=<name> is a global search. It needs a query term, but any term works as an existence oracle: a hit confirms the username exists somewhere on the instance and returns the display name.
Emails are correctly stripped from these responses, so the exposure is limited to identities (usernames and display names), but that's still an instance-wide directory that a share-link holder should never see.
The fix is to resolve the caller with GetFromAuth in both handlers, so link-share tokens are rejected the same way v1 already rejects them.
PoC
- Get a link-share token. With any account that owns a project, create a read-only link share and note the hash, then exchange it:
POST /api/v1/shares/<hash>/auth
{"password":""}
The response contains a token, a link-share JWT.
- Confirm v1 blocks it (the fixed behavior). With that token:
GET /api/v1/projects/<id>/projectusers
Authorization: Bearer <link_share_token>
→ rejected: the token isn't a user token.
- Now the vulnerable v2 endpoints, same token:
GET /api/v2/projects/<id>/users/search
Authorization: Bearer <link_share_token>
→ 200, full list of everyone with access to the project and its parents (id, username, name).
GET /api/v2/users?q=admin
Authorization: Bearer <link_share_token>
→ 200, a non-empty result confirms the username exists on the instance. Iterate q over a wordlist to enumerate accounts.
Impact
Information disclosure. A link share is a low-trust credential meant to expose one project's contents; here it also exposes the membership of that project's parents and lets the holder probe for any username across the whole instance. Since share links are often forwarded or semi-public, this hands an untrusted recipient a map of internal users and a username-validation oracle useful for phishing and credential stuffing. No account is required beyond possessing a share link. Emails are not exposed.
Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.
Drag and drop some file here, or click to select
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability.
Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard