Live › vulnerability › CVE-2026-68582
Go to dashboardVikunja's task-collection endpoint loads a project view from the URL without checking the caller's access. Anyone holding a link-share token for one project can read bucket titles and creator usernames, names and IDs from any project on the instance, and can tell which project and view IDs exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | >= 0.24.0 | – |
Check the running Vikunja version; it is affected if it is >= 0.24.0 and <= 2.3.0.
Upgrade Vikunja to 2.4.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-68582")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.