EUVD-2026-119388

Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling...

CVE-2026-123503 Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion

Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling...

CVE-2026-123503

Vikunja versions prior to 2.7.1 are vulnerable to an improper authorization flaw in the canDoBucket function. This vulnerability allows users with project write access to delete buckets by providing a mismatched view ID . By requesting deletion through another view's bucket endpoint, an attacker ...

CVE-2026-123503: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project…

Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling...

PT-2026-139784

Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling...