7 matches found
CVE-2026-123518
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...
CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...
EUVD-2026-119403
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...
CVE-2026-123518
Vikunja versions prior to 2.7.1 are vulnerable to an authorization bypass in the TaskBucket.CanUpdate function. The root cause is a failure to verify that both a task and its target kanban bucket belong to the same project. Consequently, an authenticated user with write access to two separate pro...
CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...
CVE-2026-123518: go-vikunja vikunja: Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write…
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...
PT-2026-139799
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...