Description
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
Published: 2026-08-02
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the task‑collection endpoint of Vikunja. It allows anyone possessing a link‑share token to request a project view that is not owned by the share, bypassing the authorization check. This results in disclosure of other tenants’ kanban bucket titles and the complete creator metadata for every view that exists on the instance. The actual task contents are restricted to the shared project and are not exposed.

Affected Systems

Vikunja, provided by go‑vikunja, from version 0.24.0 through 2.3.0 are affected. The issue is tracked in the GitHub advisories for that product.

Risk and Exploitability

At a CVSS score of 9.3, the flaw is high in severity. The absence of an EPSS score means there is no publicly available estimate of exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog. An attacker who obtains or guesses a link‑share token can exploit this flaw remotely, with no additional privileges, to read cross‑tenant metadata. No pre‑conditions beyond possession of a sharable token are needed.

Generated by OpenCVE AI on August 3, 2026 at 09:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Vikunja 2.4.0 or later to receive the patch that restores proper view authorization.
  • If an upgrade cannot be performed immediately, revoke or disable existing link‑share tokens to prevent unauthorized access.
  • Limit network exposure of the API endpoint by enforcing IP‑based access controls or firewall rules to trusted clients.

Generated by OpenCVE AI on August 3, 2026 at 09:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 02 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
Title Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
First Time appeared Vikunja
Vikunja vikunja
Weaknesses CWE-639
CPEs cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*
Vendors & Products Vikunja
Vikunja vikunja
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Vikunja Vikunja
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-03T19:57:08.647Z

Reserved: 2026-07-31T11:56:29.760Z

Link: CVE-2026-68582

cve-icon Vulnrichment

Updated: 2026-08-03T19:57:02.980Z

cve-icon NVD

Status : Received

Published: 2026-08-02T13:16:54.233

Modified: 2026-08-03T20:17:28.550

Link: CVE-2026-68582

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T09:15:03Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key