PT-2026-83232

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.24.6 through 2.3.x Description An authenticated user can destroy Kanban bucket assignments and task ordering of any project view across the entire instance. This occurs because the ProjectView.Delete function in...

CVE-2026-55065: Improper Authorization

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...