Executive brief
Vikunja is a project management and task-tracking application. A flaw in its task-collection API endpoint allows holders of public share links to view sensitive information from other projects and tenants instance-wide: kanban bucket titles and user details (usernames, display names, user IDs) from any kanban view, effectively breaking the tenant isolation that should prevent cross-tenant data access. Additionally, attackers can enumerate all project and view IDs on the instance through timing differences.
Technical details
The vulnerability is a broken object-level authorization (BOLA) flaw in the GET /api/v1/projects/{project}/views/{view}/tasks endpoint. The root cause is in TaskCollection.ReadAll (pkg/models/task_collection.go), which loads the project view directly from URL parameters without authorizing the caller against that view. For link-share token holders, the endpoint correctly pins task filtering to the share's own project but fails to re-validate the attacker-controlled view parameter against the share's permissions. This allows a holder of any link-share token to retrieve bucket records from arbitrary views across all tenants. The vulnerability also creates a project/view ID enumeration oracle (404 vs. 200/non-404 responses) usable by any link-share holder or authenticated user. The flaw was introduced in v0.24.0 with the per-view kanban feature and is fixed in v2.4.0.
Affected products
- Vikunja Vikunja >=0.24.0, <=2.3.0
Timeline
- 2026-07-19: disclosed: GitHub Security Advisory GHSA-rj9j-8772-4h6c published
- 2026-08-02: advisory: CVE-2026-68582 published
- 2026-08-02: patched: Fixed in Vikunja 2.4.0