CVE-2026-68582

Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Published Aug 2, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.

Analysis

Technical impact

The vulnerability resides in the task‑collection endpoint of Vikunja. It allows anyone possessing a link‑share token to request a project view that is not owned by the share, bypassing the authorization check. This results in disclosure of other tenants’ kanban bucket titles and the complete creator metadata for every view that exists on the instance. The actual task contents are restricted to the shared project and are not exposed.

Affected Systems

Vikunja, provided by go‑vikunja, from version 0.24.0 through 2.3.0 are affected. The issue is tracked in the GitHub advisories for that product.

Risk and Exploitability

At a CVSS score of 9.3, the flaw is high in severity. The absence of an EPSS score means there is no publicly available estimate of exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog. An attacker who obtains or guesses a link‑share token can exploit this flaw remotely, with no additional privileges, to read cross‑tenant metadata. No pre‑conditions beyond possession of a sharable token are needed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

go-vikunja

vikunja

unaffected

Version	Status	Constraints
`0.24.0`	affected	< 2.4.0

No data.

Vendor Product Versions

Vikunja

Version	Status	Scheme	Platform
`[0.24.0,2.4.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Vikunja 2.4.0 or later to receive the patch that restores proper view authorization.
If an upgrade cannot be performed immediately, revoke or disable existing link‑share tokens to prevent unauthorized access.
Limit network exposure of the API endpoint by enforcing IP‑based access controls or firewall rules to trusted clients.

Generated by OpenCVE AI on August 3, 2026 at 09:13 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rj9j-8772-4h6c	Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.330% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c
https://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token

History

Aug 3, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 2, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
Title		Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
First Time appeared		Vikunja Vikunja vikunja
Weaknesses		CWE-639
CPEs		cpe:2.3:a:vikunja:vikunja::::::::
Vendors & Products		Vikunja Vikunja vikunja
References		https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c https://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`