Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M

CVE-2026-55065Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 56.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the path project, and ProjectView.Delete in pkg/models/project_view.go continues after the scoped project_views delete affects no rows. Its subsequent deletes select task_buckets and task_positions only by project_view_id, allowing cross-tenant destruction of Kanban assignments and ordering while leaving the victim view and tasks intact. This issue is fixed in version 2.4.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gocode.vikunja.io/api2.4.0GHSA-gg93-x632-9ccv
Gocode.vikunja.io/apino fix listedGO-2026-6313

Affected products (as reported)

VendorProductVersions
go-vikunja vikunja >= 0.24.6, < 2.4.0

Weakness: CWE-285, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References