CVE-2026-55067

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

GHSA-569V-Q83C-3J3G Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

EUVD-2026-67834

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55067

Vikunja , an open-source self-hosted task management platform, is affected by a cross-tenant mass-assignment flaw prior to 2.4.0 . In pkg/models/kanban.go, the Bucket.Update function writes the request body's project_view_id without validating the destination view; the permission check only confi...

Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Summary The kanban endpoint POST /api/v1/projects/project/views/view/buckets/bucket/tasks moves a task into a bucket. The task is identified by taskid in the request body. The endpoint's authorization check TaskBucket.CanUpdate only verifies that the caller may update the project/view/bucket name...

GHSA-5PG6-M483-7VRG Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Summary The kanban endpoint POST /api/v1/projects/project/views/view/buckets/bucket/tasks moves a task into a bucket. The task is identified by taskid in the request body. The endpoint's authorization check TaskBucket.CanUpdate only verifies that the caller may update the project/view/bucket name...

CVE-2026-55066

Vikunja (open-source self-hosted task management) has a cross-tenant IDOR in the kanban move-task endpoint. The task_id field is attacker-controlled via the request body, yet TaskBucket.CanUpdate only authorizes the project/view/bucket from the URL — never the task itself. Because Task.ReadOne pe...

CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

EUVD-2026-67833

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

CVE-2026-55065 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...

CVE-2026-55065 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...

CVE-2026-55065

Vikunja (open-source self-hosted task management platform) versions 0.24.6 through 2.4.0 are affected by an authorization bypass in ProjectView.Delete. The permission check (CanDelete) verifies admin status for the URL-supplied project but never confirms the view actually belongs to that project....

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

EUVD-2026-51992

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582

Vikunja up to 2.3.0 contains a broken object level authorization (BOLA) in the task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks. The endpoint loads the requested project view from the URL path without validating the caller’s authorization, allowing a link-share token hol...

CVE-2026-68582

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...