AIKIDO-2026-327664

TL;DR

TaskCollection.ReadAll resolves the project view from the URL path via GetProjectViewByIDAndProject before any authorization check, and the link-share branch pins task scope to the share's own project while still using that attacker-controlled view. A holder of any project share link can therefore request another tenant's kanban view and receive that view's bucket records, including bucket titles and each bucket's full created_by user object (username, name, and id), for every view on the instance. The same pre-authorization view load also acts as a project/view-ID existence oracle via 404 versus non-404 responses. The fix pins the requested project to the link share's own project before the view is loaded so foreign views cannot be resolved.