CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...

CVE-2026-123518

Vikunja versions prior to 2.7.1 are vulnerable to an authorization bypass in the TaskBucket.CanUpdate function. The root cause is a failure to verify that both a task and its target kanban bucket belong to the same project. Consequently, an authenticated user with write access to two separate pro...

CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...