CVE-2026-55065: Vikunja authorization bypass in project view deletion

CVE-2026-55065 · Severity: high · CVSS 8.1 · Published 2026-08-28

Vikunja is a collaborative task-management and Kanban board application. A flaw in the project view deletion logic allows any authenticated user to permanently destroy the Kanban board layout (column assignments and task ordering) for any other user's project view on the same instance. An attacker needs only basic user registration and knowledge of any view ID to trigger cross-tenant data destruction with no recovery path outside of database restoration.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-55065 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55065 being exploited in the wild.
How severe is CVE-2026-55065?
High severity, with a CVSS score of 8.1, published 28 August 2026.
Which products and versions are affected?
code.vikunja.io/api (Go) >= 0.24.6, < 2.4.0, SEMVER:introduced=0.24.6, SEMVER:introduced=0.24.6,fixed=2.4.0; Vikunja >= 0.24.6, < 2.4.0.
Is there a fix for CVE-2026-55065?
Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55065 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55065?
Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • code.vikunja.io/api (Go): upgrade to 2.4.0 or later
    go get code.vikunja.io/api@v2.4.0

Technical details

The vulnerability is a cascade-without-coupling authorization bypass in the ProjectView.Delete model method (pkg/models/project_view.go, line 250). The method executes three SQL statements: the first DELETE is properly scoped to (view_id, project_id), but the next two unscoped deletes on task_buckets and task_positions filter only on the URL-supplied project_view_id. The permission check (CanDelete) verifies admin status of the claimed project but never confirms that the view ID actually belongs to that project. When the scoped first DELETE matches zero rows (view not in project), xorm silently continues execution without error, allowing the subsequent unscoped deletes to operate on any view matching the bare ID. Attack requires network access and valid authentication (trivially obtained via local-auth registration on default deployments). An attacker can destroy Kanban layouts system-wide by iterating view IDs and calling DELETE /api/v1/projects/&lt;own-project&gt;/views/&lt;target-view-id&gt;. Patches available in version 2.4.0 and later.

Affected products

  • Vikunja Vikunja API >= 0.24.6, < 2.4.0

Identifiers

  • CVE-2026-55065
  • GHSA-gg93-x632-9ccv
  • GO-2026-6313

Timeline

  • 2026-07-19: disclosed: GitHub advisory published
  • 2026-08-28: advisory: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.