CVE-2026-68582Medium· 6.5▾ TwilightPoC availableVikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view f…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.4%
1 GitHub repo
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
code.vikunja.io/api >= 0.24.0, <= 2.3.0Patched in:
code.vikunja.io/api 2.4.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-p4r4-8cxw-pjx7Critical· 6.5Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2026-76216High· 7.5Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards
CVE-2026-68581High· 8.1Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management
CVE-2026-111921Medium· 5.4Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
CVE-2026-57458High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform