fkie_cve-2026-55066

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.

GHSA-5pg6-m483-7vrg — Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Affected: Go: code.vikunja.io/api

## Summary

The kanban endpoint `POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks` moves a task into a bucket. The task is identified by `task_id` in the **request body**. The endpoint's authorization check (`TaskBucket.CanUpdate`) only verifies that the caller may update the *project/view/bucket named in the URL* — it never checks any permission on `task_id`.

Any authenticated user can therefore supply another user's task ID (task IDs are a global, sequential integer space) against a kanban bucket in their **own** project. The server loads that victim task with no authorization check, returns its full contents in the response, and — when the target bucket is a "done" bucket — writes to the victim task's row.

This is the same vulnerability class Vikunja has already remediated for task relations (CVE-2026-33676), task attachments (CVE-2026-33678), task comments (CVE-2026-33313) and CalDAV task read (CVE-2026-35598). `TaskBucket` is the task-child operation that was missed.

---

## Root cause

### 1. `task_id` is body-controlled and never permission-checked

`pkg/models/kanban_task_bucket.go:32`:

type TaskBucket struct { BucketID int64 `... json:"bucket_id" param:"bucket"` TaskID int64 `... json:"task_id"` // body-bound only — no param tag ProjectViewID int64 `... json:"project_view_id" param:"view"` ProjectID int64 `xorm:"-" json:"-" param:"project"` ... }

The web handler `Upd…

Most recent entries from all

fkie_cve-2026-55066

GHSA-5pg6-m483-7vrg — Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id