CVE-2026-91983: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups (task comments, reactions, time entry counts) without checking whether the token holds those scopes. A token scoped only to tasks read permissions can therefore read task comments and reactions it was explicitly not granted.