CVE-2026-55064 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

CVE-2026-55064

Vikunja (open-source self-hosted task management platform) versions 2.3.0 through 2.4.0 contain an incomplete fix for CVE-2026-35595. The authorization checks in pkg/models/project_permissions.go and pkg/models/project.go only gate reparent operations when parent_project_id > 0, but UpdateProj...

EUVD-2026-67831

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...