PT-2026-67335 · Vikunja · Vikunja

CVE-2026-68582 · Published 2026-08-02 · Updated 2026-08-02

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.24.0 through 2.3.0

Description A broken object level authorization (BOLA) issue exists in the task-collection endpoint 'GET /api/v1/projects/{project}/views/{view}/tasks'. The system loads the project view from the URL path without verifying if the caller is authorized to access it. For users holding a link-share token, while the task scope is limited to the shared project, the view is retrieved from the attacker-controlled path without re-validation. This allows a link-share token holder to read kanban bucket records from any tenant in the instance, including bucket titles and the created by user object containing username, name, and id. Additionally, the lack of pre-authorization creates an existence oracle for project and view IDs, allowing authenticated users and link-share holders to determine if specific IDs exist based on the server response (404 vs. non-404). Task contents are not disclosed.

Recommendations Update to version 2.4.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-68582

GHSA-RJ9J-8772-4H6C

Affected Products

Vikunja

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68582.json · Exploit
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-68582 · Security Note
• https://osv.dev/vulnerability/CVE-2026-68582 · Vendor Advisory
• https://vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token · Note