CVE-2026-68582
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the GET /api/v1/projects/{project}/views/{view}/tasks endpoint. The endpoint loads the project view from the URL path without verifying authorization. A link-share token holder can read kanban bucket records (bucket titles and full created_by user object) from any view in the instance. The missing authorization also creates a project/view existence oracle (404 vs non-404). Task contents remain constrained to the share's own project.
Risk Assessment
An attacker with any project share link can read sensitive data (bucket titles, user information) from other projects and detect the existence of projects/views, compromising data confidentiality and privacy.
Recommendation
Update Vikunja to version 2.4.0 or later, which contains the fix. Restrict the use of share links to trusted users.
Other vulnerabilities in Vikunja
See all- CVE-2026-56765Critical
A vulnerability in Vikunja before version 2.2.1 allows unauthorized access to share hashes and downloading/deleting all file attachments across the instance. An authorization flaw in the LinkSharing.ReadAll and GetTaskAttachment endpoints enables privilege escalation to admin-level shares.
- CVE-2026-55067Medium
Vikunja before version 2.4.0 allows mass assignment of the project_view_id value in POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}. The permission check validates that the bucket belongs to the URL project and view but does not validate the destination view in the body, allowing any authenticated user to relocate an attacker-owned bucket into another tenant's Kanban view.
- CVE-2026-55066High
Vikunja before version 2.4.0 has a vulnerability in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint. Authorization only checks the project, view, and bucket from the URL, but does not check task permissions, allowing an authenticated user to read and modify tasks from other tenants.
- CVE-2026-55065High
Vikunja from version 0.24.6 to 2.4.0 has a vulnerability in the DELETE /api/v1/projects/:project/views/:view endpoint. An authenticated user can supply a view identifier from another project while authorization only checks the project identifier, allowing deletion of Kanban assignments and task ordering in other tenants.
- CVE-2026-55064Medium
Vikunja from 2.3.0 until 2.4.0 allows a user with Write but not Admin permission on a shared child project to detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The authorization check bypasses the Admin requirement for zero values, allowing bypass of the fix for CVE-2026-35595.
- CVE-2026-54766Medium
Vikunja from 0.21.0 until 2.4.0 allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project. The permission check in the duplication operation skips the write-permission requirement for the parent project, allowing injection of content into another user's or team's project hierarchy.
- CVE-2026-76216High
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
- CVE-2026-68581High
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. A link-share JWT with a matching ID can be used to manage another user's tokens.
Original NVD description (English source)
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.