Executive brief
Vikunja is an open-source task management and project collaboration platform. An authentication bypass flaw allows any authenticated user to inject task position records into other tenants' project views without authorization, potentially disrupting task organization and visibility in unrelated projects. This breaks data isolation between separate teams or customers.
Technical details
Vikunja before 2.6.0 contains a broken object-level authorization (CWE-639) in the task-position endpoint (POST /api/v1/tasks/{id}/position and PUT /api/v2/tasks/{id}/position). The endpoint validates that the authenticated user can update the task itself, but fails to verify that the user-supplied project_view_id belongs to the task's project or that the user has access to the target view. An authenticated attacker with write access to any task in their own project can insert task position rows into arbitrary views across other projects and tenants by enumerating sequential view IDs. The vulnerability allows data injection with position values ≥ 0.01; lower values trigger a recalculation branch that aborts on authorization checks, preventing cross-tenant writes. The issue mirrors a previously fixed kanban-bucket relocation flaw (GHSA-569v-q83c-3j3g) that was patched in 2.4.0 but not applied to the sibling position endpoint. A fix is available in version 2.6.0 and later.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-08-31: disclosed
- 2026-09-15: advisory
- 2026-09-15: patched: Version 2.6.0 released