The vulnerability resides in Vikunja’s project duplication endpoint. When an authenticated user who can read a source project requests duplication, the system checks a target parent project for write rights incorrectly. Instead of verifying that the target parent can be written to, the code only verifies that the user can create a project under the parent. As a result, the write‑permission check is bypassed and the attacker can place an attacker‑controlled duplicate inside any other user or team’s project hierarchy. The flaw is rooted in improper access control (CWE‑285) and business logic errors (CWE‑863).

go‑vikunja:vikunja, an open‑source self‑hosted task management platform. All releases from version 0.21.0 through 2.3.99 are affected. The problem was addressed in release 2.4.0; versions beyond 2.4.0 are not impacted.

The CVSS base score of 5.3 indicates a moderate impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated and possess read access to a source project. Exploitation proceeds by issuing a PUT request to the duplication API with the target parent project ID. Because the write‑permission check is omitted, an attacker effectively expands their own project content into another project hierarchy, potentially leading to data disclosure or unintended responsibility transfer.