---
id: CVE-2026-55067
title: Vikunja is an open-source self-hosted task management platform
summary: >-
  Vikunja is an open-source self-hosted task management platform. Prior to
  2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows
  the request body project_view_id value to be mass assigned by Bucket.Update in
  pkg/model…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N'
cwe:
  - CWE-639
vendor: api
product: code.vikunja.io/api
affected:
  - code.vikunja.io/api <= 2.3.0
patched:
  - code.vikunja.io/api 2.4.0
published: '2026-08-28'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55067'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/commit/b31d606b8879ebe98fbb2ac5d8b3066b86f59868
    label: security-advisories@github.com
  - url: 'https://github.com/go-vikunja/vikunja/pull/3239'
    label: security-advisories@github.com
  - url: 'https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-569v-q83c-3j3g
    label: security-advisories@github.com
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-569v-q83c-3j3g
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-569v-q83c-3j3g'
tags:
  - nvd
  - ghsa
  - go
epss: 0.00336
epssPercentile: 0.24224
aliases:
  - GHSA-569v-q83c-3j3g
ecosystem: go
ingestedAt: '2026-08-28T17:22:56.403Z'
---

## Overview

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to the URL project and view but does not validate the body selected destination view, allowing any authenticated user to relocate an attacker-owned bucket into another tenant’s Kanban view. The injected bucket retains attacker-controlled content and ownership, enabling cross-tenant defacement. This issue is fixed in version 2.4.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55067)

Affected packages:

- `code.vikunja.io/api <= 2.3.0`

Patched in:

- `code.vikunja.io/api 2.4.0`

Source: https://github.com/advisories/GHSA-569v-q83c-3j3g