## Summary
Vikunja versions before 2.6.0 expose a link-share secret credential (“hash”) to users who only have project read permission via single-share read endpoints. Attackers can use the disclosed hash to mint a link-share JWT with the share’s permission level, enabling unauthorized writes or administrative actions.
## Technical Details
- A read-only project member can call:
- GET /api/v1/projects/{project}/shares/{share}
- GET /api/v2/projects/{project}/shares/{share}
- The permission gate is LinkSharing.CanRead (in pkg/models/link_sharing_permissions.go), which delegates to project.CanRead(s, a)—so any user with project read access passes.
- The response serializes the secret credential via the hash field (in pkg/models/link_sharing.go, json:"hash"). The share password is cleared, but the hash is not restricted.
- The sibling list endpoint GET /projects/{project}/shares uses a stronger gate (LinkSharing.ReadAll) requiring project.IsAdmin (fixed in the earlier class for the list endpoint).
- Exploitation chain described:
- Disclose hash → POST /api/v1/shares/{hash}/auth (unauthenticated by design) → obtain link-share JWT with the share’s permission level → perform API actions at that level.
## Affected
- Vikunja: before 2.6.0 (verified on 2.5.0; earlier versions likely affected)
- Affected endpoints:
- GET /api/v1/projects/{project}/shares/{share}
- GET /api/v2/projects/{project}/shares/{share}
## Impact
- Privilege escalation from project read-only access to the share’s permission level (read / read-write / admin).
- Enables unauthorized writes or administrative actions depending on the share’s configured permission.
## Mitigation
1. Upgrade Vikunja to 2.6.0 or later to address the link-share hash disclosure in single-share read endpoints.
2. Review and rotate any link-share credentials/tokens if your environment may have been exposed (the issue involves a bearer credential used to mint JWTs).
3. Monitor for unusual use of POST /api/v1/shares/{hash}/auth originating from accounts that only have project read permissions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200