Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the "LinkSharing.ReadAll()" method allows link share authenticated users to list all link shares for a project, including their secret hashes. While "LinkSharing.CanRead()" correctly blocks link share users from reading individual shares via "ReadOne", the "ReadAllWeb" handler bypasses this check by never calling "CanRead()". An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.