Vikunja versions prior to 2.7.1 contain a mis‑implemented authorization check in the canDoBucket function, allowing any user who can write to a project to delete Kanban buckets through a view ID that does not belong to the target bucket. This bypasses the normal safeguard that prevents removal of the last remaining bucket, causing dangling references to default or done buckets and resulting in inconsistent task bucket state. The flaw is a classic improper authorization vulnerability (CWE‑639).

The affected product is the open‑source project management tool Vikunja provided by the vendor go‑vikunja:vikunja. All installations running any release before version 2.7.1 are vulnerable. No specific build or platform is limited; the issue applies to self‑hosted or cloud‑based deployments using the default Kanban view implementation.

The CVSS score of 5.3 indicates a medium severity risk primarily focused on integrity and availability, rather than remote code execution. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need project write access to target the vulnerable endpoint, which can be achieved by legitimate users with such permissions. Because the flaw permits arbitrary bucket deletion, it could be abused to disrupt project workflows or persistently corrupt configuration state. Immediate attention is recommended to mitigate potential data loss or service disruption.