CVE-2026-56765 Vikunja CVE debrief

Who should care

Administrators and users of Vikunja instances, especially those with read access to shared resources, should be aware of this vulnerability and take immediate action to update to version 2.2.1 or later. Review and restrict access to the LinkSharing.ReadAll endpoint and implement additional access controls for the GetTaskAttachment endpoint.

Technical summary

The vulnerability consists of two main issues. First, the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, allowing them to escalate their privileges to admin-level shares. Second, the GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches attachments by sequential ID without verifying ownership. This allows attackers to download and delete all file attachments across all projects instance-wide. Affected Vikunja instances should be updated to version 2.2.1 or later.

Defensive priority

High, as it allows for significant privilege escalation and data access. Immediate action is required to secure Vikunja instances against this vulnerability. Monitor for suspicious activity related to file attachments and share hashes, and review compensating controls for exposed systems while remediation is scheduled and verified. Ensure that all instances are updated to version 2.2.1 or later, and consider implementing additional security measures such as enhanced monitoring and incident response plans. Conduct a thorough review of current access controls and ensure that they are properly enforced. Implement asset inventory and tracking to ensure that all affected systems are accounted for and remediated. Consider rollback change windows to ensure that any changes made to the system are properly verified and validated. Track exceptions and retest remediated assets to ensure that the vulnerability has been fully mitigated. Close the item only after evidence is documented that the vulnerability has been remediated and that all necessary security measures have been implemented. Review relevant monitoring, detection, and logs for exposed assets that need extra review. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Review compensating controls for exposed systems while remediation is scheduled and verified. Ensure that all instances are updated to version 2.2.1 or later, and consider implementing additional security measures such as enhanced monitoring and incident response plans. Conduct a thorough review of current access controls and ensure that they are properly enforced. Implement asset inventory and tracking to ensure that all affected systems are accounted for and remediated. Consider rollback change windows to ensure that any changes made to the system are properly verified and validated. Track exceptions and

Recommended defensive actions

• Update Vikunja to version 2.2.1 or later
• Review and restrict access to the LinkSharing.ReadAll endpoint
• Implement additional access controls for the GetTaskAttachment endpoint
• Monitor for suspicious activity related to file attachments and share hashes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-10T15:16:43.727Z and last modified on 2026-07-10T17:56:00.910Z. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. Evidence is limited to CVE and NVD data. Defenders should verify affected Vikunja instances and review access controls.

Official resources