An authorization bypass vulnerability in Vikunja allows any authenticated user to access or delete unauthorized system attachments, posing a significant risk to data confidentiality and integrity.

The application fails to validate the task ID against the attachment ID during retrieval, allowing authenticated users to bypass authorization controls. Because attachment IDs are sequential integers, an attacker can easily enumerate and target attachments belonging to tasks in other projects.

Successful exploitation of this vulnerability allows unauthorized users to view, download, or delete sensitive files stored as attachments across the entire system. Given the CVSS score of 8.1, this flaw represents a High severity risk, as it permits lateral access to data outside of an attacker's authorized scope and potentially disrupts business operations through arbitrary file deletion.

Immediate Action: Upgrade the Vikunja instance to version 2.2.1 or later immediately to apply the necessary authorization logic fixes.

Proactive Monitoring: Review application access logs for unusual patterns of sequential attachment ID requests or unauthorized attempts to access attachment endpoints by low-privileged users.

Compensating Controls: Implement strict network-level access controls to limit the exposure of the Vikunja API, and ensure that a Web Application Firewall is configured to detect and block suspicious, repetitive requests targeting attachment-related URLs.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

This vulnerability presents a clear risk to the confidentiality and integrity of data stored within Vikunja. Administrators should treat this as a high-priority update, as the lack of proper authorization checks permits unauthorized access to potentially sensitive organizational information. Apply the 2.2.1 patch as soon as possible to remediate this exposure.