# CVE-2026-68582: Vikunja broken object level authorization in task-collection endpoint

Source: https://junglewise.ai/threats/cve-2026-68582-vikunja-broken-object-level-authorization-in-task-collection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-68582 · Severity: critical · CVSS 6.5 · Published 2026-08-02

Vikunja is a project management and task-tracking application. A flaw in its task-collection API endpoint allows holders of public share links to view sensitive information from other projects and tenants instance-wide: kanban bucket titles and user details (usernames, display names, user IDs) from any kanban view, effectively breaking the tenant isolation that should prevent cross-tenant data access. Additionally, attackers can enumerate all project and view IDs on the instance through timing differences.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api), [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-68582 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68582 being exploited in the wild.

**How severe is CVE-2026-68582?** Critical severity, with a CVSS score of 6.5, published 2 August 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) >= 0.24.0, <= 2.3.0, SEMVER:introduced=0.24.0, SEMVER:introduced=0.24.0,fixed=2.4.0; Vikunja >=0.24.0, <=2.3.0.

**Is there a fix for CVE-2026-68582?** Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68582 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-68582?** Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.vikunja.io/api (Go): upgrade to 2.4.0 or later

  ```sh
  go get code.vikunja.io/api@v2.4.0
  ```


## Technical details

The vulnerability is a broken object-level authorization (BOLA) flaw in the GET /api/v1/projects/{project}/views/{view}/tasks endpoint. The root cause is in TaskCollection.ReadAll (pkg/models/task_collection.go), which loads the project view directly from URL parameters without authorizing the caller against that view. For link-share token holders, the endpoint correctly pins task filtering to the share's own project but fails to re-validate the attacker-controlled view parameter against the share's permissions. This allows a holder of any link-share token to retrieve bucket records from arbitrary views across all tenants. The vulnerability also creates a project/view ID enumeration oracle (404 vs. 200/non-404 responses) usable by any link-share holder or authenticated user. The flaw was introduced in v0.24.0 with the per-view kanban feature and is fixed in v2.4.0.

## Affected products

- Vikunja Vikunja >=0.24.0, <=2.3.0

## Identifiers

- CVE-2026-68582
- GHSA-rj9j-8772-4h6c
- GO-2026-6749

## Timeline

- 2026-07-19: disclosed: GitHub Security Advisory GHSA-rj9j-8772-4h6c published
- 2026-08-02: advisory: CVE-2026-68582 published
- 2026-08-02: patched: Fixed in Vikunja 2.4.0

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c)
- [https://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token](https://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)