Executive brief
Vikunja is a collaborative task-management and Kanban board application. A flaw in the project view deletion logic allows any authenticated user to permanently destroy the Kanban board layout (column assignments and task ordering) for any other user's project view on the same instance. An attacker needs only basic user registration and knowledge of any view ID to trigger cross-tenant data destruction with no recovery path outside of database restoration.
Technical details
The vulnerability is a cascade-without-coupling authorization bypass in the ProjectView.Delete model method (pkg/models/project_view.go, line 250). The method executes three SQL statements: the first DELETE is properly scoped to (view_id, project_id), but the next two unscoped deletes on task_buckets and task_positions filter only on the URL-supplied project_view_id. The permission check (CanDelete) verifies admin status of the claimed project but never confirms that the view ID actually belongs to that project. When the scoped first DELETE matches zero rows (view not in project), xorm silently continues execution without error, allowing the subsequent unscoped deletes to operate on any view matching the bare ID. Attack requires network access and valid authentication (trivially obtained via local-auth registration on default deployments). An attacker can destroy Kanban layouts system-wide by iterating view IDs and calling DELETE /api/v1/projects/<own-project>/views/<target-view-id>. Patches available in version 2.4.0 and later.
Affected products
- Vikunja Vikunja API >= 0.24.6, < 2.4.0
Timeline
- 2026-07-19: disclosed: GitHub advisory published
- 2026-08-28: advisory: Advisory updated