CVE-2026-55066: go-vikunja vikunja

Vulnerability summary

CVE-2026-55066 is a high (CVSS 7.1) vulnerability in go-vikunja vikunja. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Timeline

1. 28-08-2026
   PublishedVulnerability first disclosed.
2. 31-08-2026
   Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.