Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.
Published: 2026-08-28
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an authenticated user to use the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint to submit any task_id, bypassing authorization on the task itself. Because task identifiers are globally unique, an attacker can reference tasks from other tenants, read their data, and toggle their completion status. This leads to unauthorized modification of task state and potential data integrity abuse, classified as CWE‑639.

Affected Systems

The affected application is the open‑source Vikunja task manager (go‑vikunja:vikunja). Versions prior to 2.4.0, including all 2.3.x releases, are vulnerable via both the v1 and v2 API routes. Upgrading to version 2.4.0 or later resolves the IDOR issue.

Risk and Exploitability

The CVSS score of 7.1 reflects a Moderate severity with an attacker capable of modifying data that they should not control. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. However, the attack requires only valid credentials, and the ability to enumerate global task identifiers means that once an attacker gains access to any project, they can abuse the API across tenants. Prompt patching is advised to mitigate this risk.

Generated by OpenCVE AI on August 28, 2026 at 20:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Vikunja to version 2.4.0 or newer, which removes the insecure task_id handling.
  • Configure the application to enforce project-level permissions on the /api/v1/... endpoints, ensuring that only owners of a project can submit task IDs.
  • Enable logging and monitoring of the /api/v1/.../buckets/.../tasks endpoint to detect unauthorized task manipulation attempts and block suspicious requests.

Generated by OpenCVE AI on August 28, 2026 at 20:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-5pg6-m483-7vrg Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
History

Fri, 28 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Go-vikunja
Go-vikunja vikunja
Vendors & Products Go-vikunja
Go-vikunja vikunja

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.
Title Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Go-vikunja Vikunja
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-28T16:51:48.114Z

Reserved: 2026-06-16T14:33:35.710Z

Link: CVE-2026-55066

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T20:18:23.897

Modified: 2026-08-28T20:18:23.897

Link: CVE-2026-55066

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T21:00:04Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key