Vikunja makes task deletion effortless.

A rather spectacular CVSS 9.3 vulnerability in the self-hosted Vikunja task platform lets unauthenticated attackers permanently delete file attachments instance-wide. All a remote threat needs is a single public shared link to exploit this charming mix of link share hash disclosure and IDOR flaws. This mess plagues users of this open-source task tool, who now face complete data loss. Surviving this requires absolute secrecy with public shared links, though expecting users to keep secrets is a laugh.