The vulnerability in Vikunja allows an authenticated user to delete a view in another project by supplying an arbitrary view identifier while only authorizing against the supplied project identifier. ProjectView.CanDelete fails to verify that the view belongs to the target project, and ProjectView.Delete continues even when no rows are affected for the scoped delete. This permits cross‑tenant destruction of Kanban assignments and ordering without affecting the view or tasks themselves. The weakness is reflected in the CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User‑Controlled Key) categories, indicating that the integrity of project data can be compromised.

Vikunja, the open‑source self‑hosted task management platform from go‑vikunja, is affected in all releases from version 0.24.6 through, but not including, 2.4.0. Users running any of these versions should treat the system as vulnerable until the fix in 2.4.0 or a newer release is applied.

The CVSS score of 8.1 demonstrates a high severity level, meaning the vulnerability can cause significant damage if exploited. The EPSS score is not available, so exploitation probability is unknown, but the lack of any listing in the CISA KEV catalog suggests no confirmed active exploitation. The attack vector requires the attacker to be authenticated and to have permissions to delete views for the target project, yet the validation logic is bypassed. An attacker can therefore manipulate the order and assignments of tasks in another project, potentially disrupting project workflows and causing confusion among users.