CVE-2026-123518

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state.

• CWE-639

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w64q-7p4m-j8g8
• https://www.vulncheck.com/advisories/vikunja-before-2.7.1-missing-authorization-in-kanban-task-bucket-move

Published

Nov 8, 2026

Last Modified

Nov 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123512Vikunja before 2.7.1 embeds live password-reset, email-confi…6.1
• CVE-2026-123513Vikunja before 2.7.1 contains a credential exposure vulnerab…6.8
• CVE-2026-123514Vikunja before 2.7.1 contains an improper resource cleanup v…4.3
• CVE-2026-123515Vikunja before 2.7.1 contains a client-side request forgery …4.1
• CVE-2026-123516Vikunja before 2.7.1 contains a resource exhaustion vulnerab…4.3
• CVE-2026-123517Vikunja before 2.7.1 contains an information disclosure vuln…4.3
• CVE-2026-123519Vikunja before 2.7.1 contains a denial of service vulnerabil…6.5
• CVE-2026-12352This vulnerability allows an unauthenticated actor to bypass…5.9
• CVE-2026-123520Vikunja from 0.18.0 before 2.7.1 contains a privilege escala…7.1
• CVE-2026-123521Vikunja before 2.7.1 contains an improper restriction of exc…5.9
• CVE-2026-123522Vikunja before 2.7.1 contains an authorization bypass vulner…7.1
• CVE-2026-123523Vikunja before 2.7.1 contains an uncontrolled resource consu…6.5