Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123503Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion
Medium 5.4
In plain English
A medium-severity authorization bypass via user-controlled key in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling default/done bucket references and inconsistent task buckets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- GitHub Security Advisory (GHSA-9xh7-5jg8-mf43) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion third-party-advisory