CVE-2026-55066

Vikunja, an open-source self-hosted task management platform, contains an authorization flaw (CWE-639) in its kanban bucket-task endpoint prior to version 2.4.0: TaskBucket.CanUpdate only validates the project, view, and bucket taken from the URL, never checking whether the task_id supplied in the request body actually belongs to that project. An authenticated user can exploit this by sending a POST to /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks with an arbitrary task_id; because task identifiers are global sequential values, the endpoint returns the victim task's contents via Task.ReadOne and, when the chosen bucket is a done bucket, updates the task's completion state. The attacker therefore gains unauthorized read access to task details outside their own project (cross-tenant information disclosure) and can tamper with task done/undone metadata (integrity impact), through both the v1 and v2 API routes that share this model. Any Vikunja deployment running a version before 2.4.0 is affected, with the greatest impact on multi-project or multi-tenant instances where users should only see their own tasks. There is no known public exploit, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at roughly 0.3%, so no active exploitation is currently known.

What to do: Upgrade Vikunja to version 2.4.0 or later, which adds the missing task-level permission check. Until patched, prioritize instances with multiple projects or tenants, review application logs for POST requests to the bucket-task endpoints referencing task IDs outside the caller's project, and be alert to unexpected changes in task done/undone state.