Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck

CVE-2026-123518Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state.

Affected products (as reported)

Vendor	Product	Versions
go-vikunja	vikunja	0 – before 2.7.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-w64q-7p4m-j8g8) vendor-advisory
VulnCheck Advisory: Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move third-party-advisory