{"id":"CVE-2026-68582","kind":"vulnerability","aliases":["CVE-2026-68582","GHSA-rj9j-8772-4h6c","GO-2026-6749"],"related":[],"title":"Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api","description":"Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.","summary":"Vikunja's task-collection endpoint loads a project view from the URL without checking the caller's access. Anyone holding a link-share token for one project can read bucket titles and creator usernames, names and IDs from any project on the instance, and can tell which project and view IDs exist.","severity":"critical","cvss":9.3,"epss":0.00267,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":">= 0.24.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","runtime","self-hosted","vikunja"],"not_affected_if":["version-2.4.0-or-later","version-below-0.24.0"],"how_to_check":"Check the running Vikunja version; it is affected if it is >= 0.24.0 and <= 2.3.0.","fix":"Upgrade Vikunja to 2.4.0 or later.","status":"open","published_at":"2026-08-02T13:16:54+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:43:49+00:00","updated_at":"2026-10-23T21:43:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:43:49Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Vikunja to 2.4.0 or later.","reach":"internet","impact":"medium","summary":"Vikunja's task-collection endpoint loads a project view from the URL without checking the caller's access. Anyone holding a link-share token for one project can read bucket titles and creator usernames, names and IDs from any project on the instance, and can tell which project and view IDs exist.","category":"runtime","who_cares":["vikunja","self-hosted","go"],"confidence":0.8,"needs_auth":"yes","worst_case":"Link-share holder reads other tenants' bucket data and usernames instance-wide","analyst_note":"","how_to_check":"Check the running Vikunja version; it is affected if it is >= 0.24.0 and <= 2.3.0.","needs_analyst":false,"not_affected_if":["version-below-0.24.0","version-2.4.0-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000927,"input_tokens":3141,"output_tokens":1225,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':24A,33A,36A '-4':30A '-404':233C '-6749':34A '-68582':25A,37A '/api':22A,40A '/api/v1/projects':121C '/tasks':125C '/views':123C '0.24.0':103C '2.3.0':105C '2.4.0':258C '404':230C '8772':29A 'access':65B 'also':224C 'anyon':66B 'attack':171C 'attacker-control':170C 'authent':240C 'author':111C,142C,221C 'bola':18A,112C 'broken':108C 'bucket':11A,78B,196C,198C 'caller':63B,140C 'check':61B 'code.vikunja.io':21A,39A 'code.vikunja.io/api':20A,38A 'collect':51B,118C 'constrain':245C 'contain':106C 'content':243C 'control':172C 'creat':203C,225C 'creator':81B 'cve':23A,35A 'disclos':255C 'endpoint':52B,119C,127C 'enumer':13A 'everi':211C 'exist':100B,228C 'fix':256C 'full':202C 'get':120C 'ghsa':27A 'ghsa-rj9j':26A 'go':32A,41B 'h6c':31A 'hold':67B 'holder':151C,183C 'host':45B 'id':85B,99B,209C 'instanc':16A,91B,215C 'instance-wid':15A 'kanban':10A,195C 'level':110C 'link':3A,70B,148C,188C,236C 'link-shar':2A,69B,147C 'load':53B,128C,223C 'miss':218C 'name':83B,208C 'never':175C 'non':232C 'object':109C,206C 'one':74B 'oracl':229C 'ordinari':239C 'path':136C,173C 'pin':156C 'pre':220C 'pre-author':219C 'project':55B,75B,88B,96B,122C,131C,162C,186C,251C 'project/view-id':227C 're':177C 're-valid':176C 'read':6A,77B,190C 'record':197C 'remain':244C 'request':130C 'result':181C 'rj9j':28A 'runtim':42B 'scope':154C 'self':44B 'self-host':43B 'share':4A,71B,149C,159C,187C,237C,248C 'taken':167C 'task':50B,117C,153C,242C 'task-collect':49B,116C 'tell':94B 'tenant':8A,193C 'titl':79B,199C 'token':5A,72B,150C 'url':59B,135C 'usabl':234C 'user':205C,241C 'usernam':82B,207C 'usernames/ids':14A 'valid':178C 'verifi':138C 'version':102C 'view':56B,98B,124C,132C,165C,212C,222C 'vikunja':1A,46B,47B,101C 'vs':231C 'vulner':113C 'wide':17A 'without':60B,137C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-02T13:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6749","url":"https://pkg.go.dev/vuln/GO-2026-6749","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-68582","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68582","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-68582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68582","severity":null,"published_at":"2026-08-02T13:16:54+00:00","modified_at":"2026-09-08T20:34:34+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}