fkie_cve-2026-55065

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the path project, and ProjectView.Delete in pkg/models/project_view.go continues after the scoped project_views delete affects no rows. Its subsequent deletes select task_buckets and task_positions only by project_view_id, allowing cross-tenant destruction of Kanban assignments and ordering while leaving the victim view and tasks intact. This issue is fixed in version 2.4.0.

GHSA-gg93-x632-9ccv — Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Affected: Go: code.vikunja.io/api

### Summary

A user with only a single self-owned project can permanently destroy the Kanban bucket assignments (`task_buckets`) and task ordering (`task_positions`) of **any other project view in the entire instance**. The `ProjectView.Delete` model method runs three SQL statements: the first is properly scoped to `(view_id, project_id)`, but the next two cascading deletes on `task_buckets` and `task_positions` filter only on the URL-supplied `project_view_id`. The permission check (`CanDelete`) gates on Admin of the URL `:project` but never confirms that the URL `:view` actually belongs to that project.

### Details

`ProjectView.Delete` (file: `pkg/models/project_view.go`, line 250) cascades on the bare `pv.ID` for the second and third deletes, ignoring `pv.ProjectID`:

```go func (pv *ProjectView) Delete(s *xorm.Session, _ web.Auth) (err error) { _, err = s. Where("id = ? AND project_id = ?", pv.ID, pv.ProjectID). // (a) scoped — OK Delete(&ProjectView{}) if err != nil { return }

_, err = s.Where("project_view_id = ?", pv.ID).Delete(&TaskBucket{}) // (b) UNSCOPED if err != nil { return }

_, err = s.Where("project_view_id = ?", pv.ID).Delete(&TaskPosition{}) // (c) UNSCOPED return } ```

`pv.ID` and `pv.ProjectID` come straight from the URL path via `c.Bind` — see the param tags on the struct (`pkg/models/project_view.go`, lines 133–137):

```go type ProjectView struct { ID int64 `xorm:"aut…

Most recent entries from all

fkie_cve-2026-55065

GHSA-gg93-x632-9ccv — Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key