Vikunja before version 2.7.1 contains an authorization flaw in the TaskBucket.CanUpdate method such that an authenticated user may move a task from one project's Kanban bucket to another project's bucket without the system verifying that both the task and the target bucket belong to the same project. This flaw allows the user to modify the task’s state for "done" buckets and to create cross‑project task_buckets rows that affect bucket limits. The resulting unauthorized changes can lead to unintended task status updates and resource misallocation.

The issue affects the Vikunja application, specifically all releases prior to 2.7.1. Users who have write access to more than one project are at risk.

The vulnerability has a CVSS score of 5.3, indicating medium severity. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog. Exploitation requires only authenticated access and the ability to write to two different projects; no special privileges beyond those already granted to the user are needed. The attack vector is therefore limited to users within the same instance who hold write permissions on multiple projects.