CVE-2026-55066

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.

• CWE-639

• https://github.com/go-vikunja/vikunja/commit/36cdc2ce2be0b8ccc74227d178b92047d59cd65f
• https://github.com/go-vikunja/vikunja/pull/3239
• https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5pg6-m483-7vrg

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5506The Wavr plugin for WordPress is vulnerable to Stored Cross-…6.4
• CVE-2026-55060GoCD is a continuous deliver server. From 13.1.0 until 26.1.…3.7
• CVE-2026-55061uniget is a universal installer and updater for (container) …1
• CVE-2026-55062uniget is a universal installer and updater for (container) …8.4
• CVE-2026-55064Vikunja is an open-source self-hosted task management platfo…4.3
• CVE-2026-55065Vikunja is an open-source self-hosted task management platfo…8.1
• CVE-2026-55067Vikunja is an open-source self-hosted task management platfo…5
• CVE-2026-55068free5GC is an open-source implementation of the 5G core netw…9.3
• CVE-2026-55069Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5507When restoring a session from cache, a pointer from the seri…4
• CVE-2026-55071MCP-for-Stata is a MCP server for integrating Stata into age…8.4
• CVE-2026-55072Pimcore is an Open Source Data & Experience Management Platf…8.5