https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:39:11 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-55067 <p>Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to the URL project and view but does not validate the body selected destination view, allowing any authenticated user to relocate an attacker-owned bucket into another tenant’s Kanban view. The injected bucket retains attacker-controlled content and ownership, enabling cross-tenant defacement. This issue is fixed in version 2.4.0.</p> <p>Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to the URL project and view but does not validate the body selected destination view, allowing any authenticated user to relocate an attacker-owned bucket into another tenant’s Kanban view. The injected bucket retains attacker-controlled content and ownership, enabling cross-tenant defacement. This issue is fixed in version 2.4.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-55067 https://db.gcve.eu/vuln/ghsa-569v-q83c-3j3g <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>## Summary</p> <p>`POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}` mass-assigns the request body&#39;s `project_view_id` onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied `(project, view)` pair; the body&#39;s `project_view_id` is never validated. Any signed-in user can therefore take one of their own buckets and graft it into any other tenant&#39;s kanban view, with attacker-controlled title and the attacker&#39;s account as `created_by`.</p> <p>This vulnerability was found using an LLM, and manually verified against latest (2.3.0).</p> <p>## Vulnerable code</p> <p>`pkg/models/kanban.go` (lines 348-359):</p> <p>```go func (b *Bucket) Update(s *xorm.Session, _ web.Auth) (err error) { _, err = s. Where(&#34;id = ?&#34;, b.ID). Cols( &#34;title&#34;, &#34;limit&#34;, &#34;position&#34;, &#34;project_view_id&#34;, // mass-assigned from the request body ). Update(b) return } ```</p> <p>`Bucket.CanUpdate` (`canDoBucket`) only validates that the URL-supplied `{bucket}` belongs to the URL-supplied `{project}/{view}`. The body&#39;s `project_view_id` reaches `Update` unchecked and is written through.</p> <p>## Proof of Concept</p> <p>**Prerequisites:** Two registered users (`attacker` and `victim`). In the IDs below: attacker&#39;s project is `2`, kanban view `8`; victim&#39;s project is `1`, kanban view `4`.</p> <p>**Step 1:** Attacker creates a fresh bucket in their own project.</p> <p>```bash curl -s -X PUT &#39;http://localhost:13456/a…</p> <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>## Summary</p> <p>`POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}` mass-assigns the request body&#39;s `project_view_id` onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied `(project, view)` pair; the body&#39;s `project_view_id` is never validated. Any signed-in user can therefore take one of their own buckets and graft it into any other tenant&#39;s kanban view, with attacker-controlled title and the attacker&#39;s account as `created_by`.</p> <p>This vulnerability was found using an LLM, and manually verified against latest (2.3.0).</p> <p>## Vulnerable code</p> <p>`pkg/models/kanban.go` (lines 348-359):</p> <p>```go func (b *Bucket) Update(s *xorm.Session, _ web.Auth) (err error) { _, err = s. Where(&#34;id = ?&#34;, b.ID). Cols( &#34;title&#34;, &#34;limit&#34;, &#34;position&#34;, &#34;project_view_id&#34;, // mass-assigned from the request body ). Update(b) return } ```</p> <p>`Bucket.CanUpdate` (`canDoBucket`) only validates that the URL-supplied `{bucket}` belongs to the URL-supplied `{project}/{view}`. The body&#39;s `project_view_id` reaches `Update` unchecked and is written through.</p> <p>## Proof of Concept</p> <p>**Prerequisites:** Two registered users (`attacker` and `victim`). In the IDs below: attacker&#39;s project is `2`, kanban view `8`; victim&#39;s project is `1`, kanban view `4`.</p> <p>**Step 1:** Attacker creates a fresh bucket in their own project.</p> <p>```bash curl -s -X PUT &#39;http://localhost:13456/a…</p> https://db.gcve.eu/vuln/ghsa-569v-q83c-3j3g