CVE-2026-68582: Vikunja broken object level authorization in task-collection endpoint

CVE-2026-68582 · Severity: critical · CVSS 6.5 · Published 2026-08-02

Vikunja is a project management and task-tracking application. A flaw in its task-collection API endpoint allows holders of public share links to view sensitive information from other projects and tenants instance-wide: kanban bucket titles and user details (usernames, display names, user IDs) from any kanban view, effectively breaking the tenant isolation that should prevent cross-tenant data access. Additionally, attackers can enumerate all project and view IDs on the instance through timing differences.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-68582 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68582 being exploited in the wild.
How severe is CVE-2026-68582?
Critical severity, with a CVSS score of 6.5, published 2 August 2026.
Which products and versions are affected?
code.vikunja.io/api (Go) >= 0.24.0, <= 2.3.0, SEMVER:introduced=0.24.0, SEMVER:introduced=0.24.0,fixed=2.4.0; Vikunja >=0.24.0, <=2.3.0.
Is there a fix for CVE-2026-68582?
Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68582 attacked?
It is attacked over the network.
Am I affected by CVE-2026-68582?
Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • code.vikunja.io/api (Go): upgrade to 2.4.0 or later
    go get code.vikunja.io/api@v2.4.0

Technical details

The vulnerability is a broken object-level authorization (BOLA) flaw in the GET /api/v1/projects/{project}/views/{view}/tasks endpoint. The root cause is in TaskCollection.ReadAll (pkg/models/task_collection.go), which loads the project view directly from URL parameters without authorizing the caller against that view. For link-share token holders, the endpoint correctly pins task filtering to the share's own project but fails to re-validate the attacker-controlled view parameter against the share's permissions. This allows a holder of any link-share token to retrieve bucket records from arbitrary views across all tenants. The vulnerability also creates a project/view ID enumeration oracle (404 vs. 200/non-404 responses) usable by any link-share holder or authenticated user. The flaw was introduced in v0.24.0 with the per-view kanban feature and is fixed in v2.4.0.

Affected products

  • Vikunja Vikunja >=0.24.0, <=2.3.0

Identifiers

  • CVE-2026-68582
  • GHSA-rj9j-8772-4h6c
  • GO-2026-6749

Timeline

  • 2026-07-19: disclosed: GitHub Security Advisory GHSA-rj9j-8772-4h6c published
  • 2026-08-02: advisory: CVE-2026-68582 published
  • 2026-08-02: patched: Fixed in Vikunja 2.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.