Vikunja is a self‑hosted task‑management platform. In versions prior to 2.4.0, the API endpoint POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} accepted a body parameter project_view_id that was mass assigned without validating the intended destination view. This allowed an authenticated user to move a bucket they owned into any other tenant’s Kanban view. The bucket—and the data it contains—was then retained with the attacker’s ownership, effectively enabling cross‑tenant defacement. The flaw is a classic example of improper input validation (CWE‑639).

All installations of the Vikunja platform produced by go‑vikunja:vikunja that run a version earlier than 2.4.0 are affected. The vulnerability applies to the API endpoint handling bucket relocations within the Kanban module.

The vulnerability’s CVSS score of 5 indicates moderate severity, and its EPSS score is not available. It is not listed in the CISA KEV catalogue. Exploitation requires the attacker to be an authenticated user with the ability to create or move buckets. Once the user has those credentials, they can relocate a bucket into another tenant’s view, which can lead to defacement and potential data compromise. The attack vector is likely internal or via compromised legitimate credentials.