Executive brief
Vikunja is an open-source task management platform. Prior to version 2.4.0, an authenticated user could modify tasks belonging to other tenants or projects by exploiting missing authorization checks on a task bucket endpoint. An attacker could enumerate and change the completion status of arbitrary tasks across the platform, compromising data integrity and potentially disrupting workflows for other users.
Technical details
The vulnerability is an authorization bypass in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint. The TaskBucket.CanUpdate authorization check validates only the project, view, and bucket from the URL path, but fails to verify permissions on the task_id supplied in the request body. The updateTaskBucket function then calls Task.ReadOne without a separate task permission check, allowing unauthorized read and modification of task metadata. Since task identifiers are globally sequential across tenants, an authenticated user can enumerate and modify completion state of cross-tenant tasks. The vulnerability affects both v1 and v2 API routes sharing the same model. The issue is fixed in version 2.4.0.
Affected products
- Vikunja Vikunja prior to 2.4.0
Timeline
- 2026-08-28: disclosed
- 2026-07-19: patched: Fixed in version 2.4.0