https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 06:26:16 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-123518 <p>Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket&#39;s project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project&#39;s kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task&#39;s done state.</p> <p>Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket&#39;s project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project&#39;s kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task&#39;s done state.</p> https://db.gcve.eu/vuln/fkie_cve-2026-123518 https://db.gcve.eu/vuln/ghsa-c9v9-9g94-ghgc <p>Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket&#39;s project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project&#39;s kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task&#39;s done state.</p> <p>Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket&#39;s project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project&#39;s kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task&#39;s done state.</p> https://db.gcve.eu/vuln/ghsa-c9v9-9g94-ghgc