Executive brief
Vikunja is a project management and task tracking application. An authenticated user can inject kanban buckets (task columns) into other users' project views by exploiting improper input validation. An attacker could deface or disrupt a victim's task boards by creating fake buckets under the attacker's account in any accessible view.
Technical details
This is a mass-assignment vulnerability (CWE-639) in the bucket update endpoint (`POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}`). The `Bucket.Update()` function in `pkg/models/kanban.go` includes `project_view_id` in its `Cols()` allowlist, meaning any value in the request body is written to the database. The `CanUpdate()` permission check only verifies that the URL-supplied bucket ID belongs to the URL-supplied `(project, view)` pair; it does not validate that the request body's `project_view_id` matches the bucket's actual view. An authenticated attacker can create a bucket in their own view, then modify its `project_view_id` in the request body to any integer (which are sequential and enumerable), relocating it to a victim's view. The attacker's account remains as the bucket creator. After relocation, only the victim can delete the injected bucket. Patched in version 2.4.0.
Affected products
- Vikunja Vikunja <= 2.3.0
Timeline
- 2026-07-19: disclosed: Published to GitHub Advisory Database
- 2026-08-28: patched: Version 2.4.0 released with fix