Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?…

Vikunja open-source task management platform contains an authorization bypass vulnerability in versions prior to 2.2.1. The TaskAttachment.ReadOne() function queries attachments by ID only, ignoring task ID validation from URL paths. This allows authenticated users to access attachments from other projects by manipulating task and attachment IDs. The vulnerability enables unauthorized download or deletion of any attachment in the system. Sequential integer attachment IDs make enumeration trivial for attackers. Version 2.2.1 patches this authorization flaw.