The vulnerability in Vikunja prior to version 2.7.1 is an authorization bypass that allows an authenticated user to inject a crafted task object into a no‑op Kanban bucket move. By setting the task.id to a target task and the task.project_id to the attacker’s own project, the full contents of any task are routed to an attacker’s webhook and can also trigger forged mention notifications. This results in confidential task information being exposed to an unauthorized party and potentially manipulated user notifications. The flaw is classified as CWE‑639, an "Authorization Bypass Through User‑Controlled Key."

Vikunja (go‑vikunja:vikunja) versions prior to 2.7.1 are affected. No minor or patch versions after 2.7.1 are listed as vulnerable. Organizations running the open‑source task management platform should verify that their installation is 2.7.1 or later to be out of scope.

The CVSS score of 7.1 indicates a medium–high severity. EPSS is not available, but as the flaw requires an authenticated session and does not involve remote code execution, the probability of exploitation in the wild is moderate. The vulnerability is not listed in the CISA KEV catalog, so no known public exploits are reported. The attacker can exploit the flaw by sending a crafted request through the web UI or API, provided they have legitimate credentials. Mitigation is therefore primarily by patching to 2.7.1 or disconnecting the vulnerable webhook endpoint.