fkie_cve-2026-54766

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project. ProjectDuplicate.CanCreate calls parent.CanCreate on an unhydrated Project containing only the body supplied parent_project_id instead of calling parent.CanWrite, so the target parent write-permission check is skipped. The ordinary project creation path enforces that permission, but PUT /api/v1/projects/{project}/duplicate does not, allowing attacker-owned content to be injected into another user or team project hierarchy. This issue is fixed in version 2.4.0.

GHSA-f27p-pw2p-9pr4 — Vikunja has a project duplication bypasses write-permission check on the target parent project

Affected: Go: code.vikunja.io/api

## Summary

The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated (non-link-share) user can duplicate a project they can read into **any** parent project on the instance, regardless of whether they have write access to that parent — injecting an attacker-owned project into another user's or team's project hierarchy.

## Details

`ProjectDuplicate.CanCreate` (`pkg/models/project_duplicate.go`) is meant to require write access to the parent the duplicate is placed under — its own comment says "Parent project exists + user has write access". The implementation does neither correctly:

```go func (pd *ProjectDuplicate) CanCreate(s *xorm.Session, a web.Auth) (canCreate bool, err error) { pd.Project = &Project{ID: pd.ProjectID} canRead, _, err := pd.Project.CanRead(s, a) if err != nil || !canRead { return canRead, err } if pd.ParentProjectID == 0 { return canRead, err } // Parent project exists + user has write access to is (-> can create new projects) parent := &Project{ID: pd.ParentProjectID} return parent.CanCreate(s, a) // <-- bug } ```

Two defects compound here:

1. **Wrong permission method.** It calls `parent.CanCreate` ("may I create *this* project?") instead of `parent.CanWrite` ("may I create children *inside* this project?"). The latter is what the normal create path uses — `POST /projects` with a `parent_project_id` enforces `parent.CanWrite` via `Project.Can…

Most recent entries from all

fkie_cve-2026-54766

GHSA-f27p-pw2p-9pr4 — Vikunja has a project duplication bypasses write-permission check on the target parent project