CVE-2026-33313: 
NixOS vulnerability analysis and mitigation

CVE-2026-33313 is an Insecure Direct Object Reference (IDOR) vulnerability in Vikunja, an open-source self-hosted task management platform, that allows authenticated users to read arbitrary task comments without proper authorization. Prior to version 2.2.0, any authenticated user can access task comments belonging to tasks in other users' private projects by substituting a task ID they control in the API URL. The vulnerability was disclosed on March 20, 2026, and affects all Vikunja versions up to and including 2.1.0. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Feedly).

The root cause is an authorization bypass through a user-controlled key (CWE-639). The GET /api/v1/tasks/{taskID}/comments/{commentID} endpoint performs its authorization check against the attacker-supplied taskID in the URL path, but then loads the comment using only the commentID without verifying that the comment actually belongs to the specified task. Specifically, in pkg/models/task_comment_permissions.go, the CanRead() function constructs a Task object using the URL's TaskID and checks read permission against it; meanwhile, getTaskCommentSimple() in pkg/models/task_comments.go queries the database with NoAutoCondition() and filters only by id = ?, ignoring the task_id field entirely. The fix (commit bc6d843) adds an And("task_id = ?", tc.TaskID) clause to the database query, ensuring a comment can only be retrieved if it belongs to the task specified in the URL (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to read the content and author of any task comment across the entire Vikunja instance, regardless of project visibility or access controls. This results in a confidentiality breach exposing potentially sensitive information contained in task comments — such as internal notes, credentials, or business-sensitive discussions — from private projects belonging to other users. There is no integrity or availability impact; the vulnerability is limited to unauthorized read access (GitHub Advisory, Feedly).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session, limiting the attack surface to registered users of a Vikunja instance (Feedly).

1. Obtain authentication: Log in to the target Vikunja instance with any valid user account to obtain a session token or API key.
2. Identify an accessible task: Note the ID of any task the attacker has legitimate read access to (e.g., task ID A from the attacker's own project).
3. Enumerate comment IDs: Sequentially guess or enumerate comment IDs (e.g., integers starting from 1) that may belong to tasks in other users' private projects.
4. Craft the IDOR request: Send a GET request substituting the attacker's accessible task ID and the target comment ID:

   GET /api/v1/tasks/A/comments/C
   Authorization: Bearer <attacker_token>

5. Receive unauthorized data: The server performs the authorization check against task A (which passes), then loads comment C by ID alone and returns its full content and author, regardless of which task or project it actually belongs to (GitHub Advisory).

• Network: Unusual sequences of GET /api/v1/tasks/{taskID}/comments/{commentID} requests where the taskID remains constant but commentID increments sequentially, originating from a single authenticated user.
• Logs: API access logs showing a single user account repeatedly accessing comment endpoints across many different comment IDs in a short time window, particularly where the comment IDs do not correspond to tasks the user owns.
• Logs: HTTP 200 responses to comment read requests for tasks the requesting user does not own, which would indicate successful IDOR exploitation prior to patching.

Upgrade Vikunja to version 2.2.0 or later, which includes the fix that adds a task_id constraint to the comment lookup query, ensuring comments can only be retrieved if they belong to the task specified in the URL (GitHub Advisory, Fix Commit). No configuration-based workaround is available for unpatched versions; the only remediation is upgrading. Administrators should also review API access logs for anomalous comment enumeration patterns as a precautionary measure.

The vulnerability was discovered using GitHub Security Lab Taskflows and reported to the Vikunja maintainers, who published the advisory and patch promptly on March 20, 2026. The issue was part of a broader batch of security fixes in Vikunja 2.2.0, which also addressed a 2FA bypass via CalDAV Basic Auth and a disabled-user account reactivation flaw (GitHub Advisory). No significant broader media coverage or notable community controversy has been observed.