Broken object level authorization in Vikunja task-collection endpoint (CVE-2026-68582)

The task-collection endpoint `GET /api/v1/projects/{project}/views/{view}/tasks` in Vikunja resolves the requested project view from the URL path without verifying the caller is authorized for it. A holder of any project share link can supply an arbitrary view ID to read another tenant's kanban bucket records - including bucket titles and the full `created_by` user object (username, name, and ID) - for every view in the instance. The same missing pre-authorization view load exposes a project/view-ID existence oracle (404 vs. non-404) to both link-share token holders and ordinary authenticated users. Affected versions: - >= 0.24.0 - <= 2.3.0 We recommend updating to: 2.4.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c Details: https://vuln.today/cve/CVE-2026-68582