GHSA-MR3J-P26X-72X4

Vulnerability from github – Published: 2026-03-20 17:25 – Updated: 2026-03-25 20:53
VLAI?
Summary
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
Details

An authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to.

Details

The GET /api/v1/tasks/{taskID}/comments/{commentID} endpoint performs an authorization check against the task ID provided in the URL path, then loads the comment by its own ID without verifying it belongs to that task.

Root Cause

In pkg/models/task_comment_permissions.go, CanRead constructs a Task using the TaskID from the URL and checks Task.CanRead:

func (tc *TaskComment) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
    t := Task{ID: tc.TaskID}
    return t.CanRead(s, a)
}

In pkg/models/task_comments.go, getTaskCommentSimple loads the comment by ID only, with NoAutoCondition() explicitly disabling XORM's implicit struct-field filtering:

func getTaskCommentSimple(s *xorm.Session, tc *TaskComment) error {
    exists, err := s.
        Where("id = ?", tc.ID).
        NoAutoCondition().
        Get(tc)
    // ...
}

The generic web handler (pkg/web/handler/read_one.go) calls CanRead before ReadOne, so the permission check passes against the attacker-controlled task ID, and then ReadOne returns the comment from a completely different task.

Attack Scenario

  1. Attacker is authenticated and has read access to any task (task ID A) — e.g. their own task.
  2. Attacker guesses or enumerates a comment ID (C) belonging to a task in another user's private project.
  3. Attacker requests: GET /api/v1/tasks/A/comments/C
  4. Authorization passes because the attacker can read task A.
  5. The comment C is loaded by ID only and returned, leaking its contents and author.

Credit

This vulnerability was found using GitHub Security Lab Taskflows.

Severity ?
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.vikunja.io/api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33313"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T17:25:30Z",
    "nvd_published_at": "2026-03-24T15:16:35Z",
    "severity": "MODERATE"
  },
  "details": "An authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to.\n\n## Details\n\nThe `GET /api/v1/tasks/{taskID}/comments/{commentID}` endpoint performs an authorization check against the task ID provided in the URL path, then loads the comment by its own ID without verifying it belongs to that task.\n\n### Root Cause\n\nIn `pkg/models/task_comment_permissions.go`, `CanRead` constructs a `Task` using the `TaskID` from the URL and checks `Task.CanRead`:\n\n```go\nfunc (tc *TaskComment) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {\n    t := Task{ID: tc.TaskID}\n    return t.CanRead(s, a)\n}\n```\n\nIn `pkg/models/task_comments.go`, `getTaskCommentSimple` loads the comment by ID only, with `NoAutoCondition()` explicitly disabling XORM\u0027s implicit struct-field filtering:\n\n```go\nfunc getTaskCommentSimple(s *xorm.Session, tc *TaskComment) error {\n    exists, err := s.\n        Where(\"id = ?\", tc.ID).\n        NoAutoCondition().\n        Get(tc)\n    // ...\n}\n```\n\nThe generic web handler (`pkg/web/handler/read_one.go`) calls `CanRead` before `ReadOne`, so the permission check passes against the attacker-controlled task ID, and then `ReadOne` returns the comment from a completely different task.\n\n### Attack Scenario\n\n1. Attacker is authenticated and has read access to any task (task ID `A`) \u2014 e.g. their own task.\n2. Attacker guesses or enumerates a comment ID (`C`) belonging to a task in another user\u0027s private project.\n3. Attacker requests: `GET /api/v1/tasks/A/comments/C`\n4. Authorization passes because the attacker can read task `A`.\n5. The comment `C` is loaded by ID only and returned, leaking its contents and author.\n\n## Credit\n\nThis vulnerability was found using [GitHub Security Lab Taskflows](https://github.com/GitHubSecurityLab/seclab-taskflows).",
  "id": "GHSA-mr3j-p26x-72x4",
  "modified": "2026-03-25T20:53:02Z",
  "published": "2026-03-20T17:25:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-mr3j-p26x-72x4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33313"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/commit/bc6d843ed4df82a6c89f10aa676a7a33d27bf2fd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vikunja/vikunja"
    },
    {
      "type": "WEB",
      "url": "https://vikunja.io/changelog/vikunja-v2.2.0-was-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.