CVE-2026-55067Medium· 5.0▾ SunlitVikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/model…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to the URL project and view but does not validate the body selected destination view, allowing any authenticated user to relocate an attacker-owned bucket into another tenant’s Kanban view. The injected bucket retains attacker-controlled content and ownership, enabling cross-tenant defacement. This issue is fixed in version 2.4.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
code.vikunja.io/api <= 2.3.0Patched in:
code.vikunja.io/api 2.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55065High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-55066High· 7.1Vikunja is an open-source self-hosted task management platform
CVE-2026-54766MediumVikunja is an open-source self-hosted task management platform
CVE-2026-55064Medium· 4.3Vikunja is an open-source self-hosted task management platform
CVE-2026-35596Medium· 4.3Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
CVE-2026-35597Medium· 5.9Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout