Junglewise Threat Intelligence

CVE-2026-54766: Vikunja project duplication authorization bypass

CVE-2026-54766 · Severity: medium · CVSS 5.3 · Published 2026-08-28

Executive brief

Vikunja is a project and task management platform. An authenticated user can duplicate any project they can read and inject it as a child of any other project on the instance, even if they lack write permission to the parent—allowing attackers to insert unauthorized content into other users' or teams' project hierarchies. This bypasses the same authorization check that the normal project creation endpoint enforces.

Technical details

The vulnerability is a logic error in `ProjectDuplicate.CanCreate()` in `pkg/models/project_duplicate.go`. It compounds two defects: (1) it calls the wrong permission method (`parent.CanCreate()` instead of `parent.CanWrite()`), and (2) the parent project is instantiated but never loaded from the database, so its fields remain uninitialized, causing the permission check to never execute. As a result, any authenticated user can call `PUT /api/v1/projects/{id}/duplicate` with an arbitrary `parent_project_id` and the authorization check will pass unconditionally. The attacker's duplicate project is created as a child of the victim's project despite no write access to it. No downstream validation re-checks authorization. The fix is to replace the call with `parent.CanWrite()`, which properly loads the project from the database and evaluates permissions.

Affected products

  • Vikunja Vikunja >= 0.21.0, <= 2.3.0

Timeline

  • 2026-07-19: disclosed
  • 2026-08-28: advisory
  • 2026-07-19: patched: Fix merged in PR #3239; patched version 2.4.0

References

Related threats