Executive brief
Vikunja is a project management and task tracking application. A user with write-only permissions on a shared child project can detach it from its parent by sending an explicit `parent_project_id=0` value, an operation that should require administrator privileges. This bypasses the access control safeguards and severs permission inheritance, potentially disrupting the project hierarchy and affecting other collaborators who relied on inherited access through the parent.
Technical details
This vulnerability is a bypass of the CVE-2026-35595 fix in Vikunja's project update handler. The root cause lies in the inability to distinguish between an omitted `parent_project_id` field (which should not trigger reparenting) and an explicit `parent_project_id: 0` value (which should detach the project). The vulnerable code at `pkg/models/project.go` lines 1018–1041 checks `if project.ParentProjectID > 0` before enforcing the Admin permission gate; when `ParentProjectID == 0`, this check is skipped entirely. Similarly, `pkg/models/project_permissions.go` line 145 skips the reparent permission check when `ParentProjectID == 0`. Since Go initializes integer fields to zero by default, and the update handler always includes `parent_project_id` in the `colsToUpdate` list, an attacker with Write permission can send `{"parent_project_id":0}` to detach the project from its parent hierarchy. No authentication bypass is required—the attacker must already be an authenticated collaborator with Write permission. The fix for this incomplete patch requires using a pointer type (e.g., `*int64`) to distinguish nil (omitted) from 0 (explicit detach), or adding a dedicated detach endpoint with its own authorization check.
Affected products
- Vikunja Vikunja >=2.3.0, <2.4.0
Timeline
- 2026-07-19: disclosed: GitHub Security Advisory published (GHSA-44v6-7fxq-vgf4)
- 2026-08-28: advisory: Advisory reviewed and updated in GitHub Advisory Database
- 2026-02-XX: patched: Fixed in v2.4.0
References
- https://api.github.com/users/AntarikshaAkhileshSharma
- https://github.com/AntarikshaAkhileshSharma
- https://api.github.com/users/AntarikshaAkhileshSharma/gists%7B/gist_id%7D
- https://api.github.com/users/AntarikshaAkhileshSharma/repos
- https://avatars.githubusercontent.com/u/64725395?v=4
- https://api.github.com/users/AntarikshaAkhileshSharma/events%7B/privacy%7D