CVE-2026-123522

Vikunja versions prior to 2.7.1 are vulnerable to an authorization bypass vulnerability. An authenticated attacker can disclose any task's content by injecting a crafted task object into a no-op Kanban bucket move operation. By setting the task.id to a victim's task and the task.project_id to the...