CVE-2026-54766

A vulnerability in Vikunja before version 2.2.1 allows unauthorized access to share hashes and downloading/deleting all file attachments across the instance. An authorization flaw in the LinkSharing.ReadAll and GetTaskAttachment endpoints enables privilege escalation to admin-level shares.

Vikunja before version 2.4.0 allows mass assignment of the project_view_id value in POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}. The permission check validates that the bucket belongs to the URL project and view but does not validate the destination view in the body, allowing any authenticated user to relocate an attacker-owned bucket into another tenant's Kanban view.

Vikunja before version 2.4.0 has a vulnerability in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint. Authorization only checks the project, view, and bucket from the URL, but does not check task permissions, allowing an authenticated user to read and modify tasks from other tenants.

Vikunja from version 0.24.6 to 2.4.0 has a vulnerability in the DELETE /api/v1/projects/:project/views/:view endpoint. An authenticated user can supply a view identifier from another project while authorization only checks the project identifier, allowing deletion of Kanban assignments and task ordering in other tenants.

Vikunja from 2.3.0 until 2.4.0 allows a user with Write but not Admin permission on a shared child project to detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The authorization check bypasses the Admin requirement for zero values, allowing bypass of the fix for CVE-2026-35595.

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the GET /api/v1/projects/{project}/views/{view}/tasks endpoint. The endpoint loads the project view from the URL path without verifying authorization. A link-share token holder can read kanban bucket records (bucket titles and full created_by user object) from any view in the instance. The missing authorization also creates a project/view existence oracle (404 vs non-404). Task contents remain constrained to the share's own project.

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. A link-share JWT with a matching ID can be used to manage another user's tokens.