A flaw in Vikunja’s project ownership calculation allows a user with write permission on a project to become an administrator of that project by moving it under a different parent project. The vulnerability stems from a logic error in the permission checking code where only the new parent’s write rights are verified, while the recursive permission lookup incorrectly grants admin rights to the moving user. The result is that an attacker can elevate their privileges to full administrative control over a project, potentially accessing sensitive data or altering project settings.

Vikunja, a self‑hosted task management platform, is affected when running any version earlier than 2.3.0. The issue is fixed in version 2.3.0 and later releases. All deployments of older versions are susceptible, regardless of hosting environment.

The vulnerability scores a high severity of 8.3 (CVSS), indicating significant impact. No EPSS or KEV information is available, but the exploit requires only authenticated access with write permission on a target project and the ability to modify its parent_project_id. Because the API is exposed over the network, a remote attacker who can authenticate may exploit this flaw, leading to local privilege escalation within the application context. The attack vector is inferred to be authenticated network access, as the attacker must control or forge the project reparenting request.