Skip to main content

Vikunja EUVDEUVD-2026-51992

| CVE-2026-68582 CRITICAL
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-02 VulnCheck GHSA-p4r4-8cxw-pjx7
Oracle Authentication Bypass Vikunja
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Requires a low-privilege share-link token (PR:L) over the network with low complexity; impact is read-only leak of low-sensitivity metadata, so C:L and I/A:N, unlike the input's VI:H/VA:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 02, 2026 - 13:01 vuln.today
Patch available
Aug 02, 2026 - 13:01 EUVD
CVE Published
Aug 02, 2026 - 12:15 cve.org
CRITICAL 9.3

DescriptionCVE.org

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records - bucket titles and the full created_by user object (username, name, id) - for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.

AnalysisAI

Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any project share link read kanban bucket records - bucket titles and the full created_by user object (username, name, id) - belonging to other tenants' project views, because the task-collection endpoint loads the view from the attacker-controlled URL path without re-authorizing it. The same missing pre-authorization check yields a project/view-ID existence oracle (404 vs non-404) usable by link shares and ordinary authenticated users. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain any project share link
Delivery
Call task endpoint with cross-tenant view ID
Exploit
Server loads view without re-authorization
Execution
Read other tenants' bucket titles and creator objects
Impact
Enumerate valid view IDs via 404 oracle
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The primary bucket-disclosure attack requires the attacker to hold a valid project share-link token for any project on the instance (Vikunja's link-share feature must be enabled and at least one share link must exist); the attacker then supplies a cross-tenant {view} ID in the path of GET /api/v1/projects/{project}/views/{view}/tasks. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals conflict sharply with the headline severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker obtains any project share link for a target Vikunja instance (e.g. a public or leaked link), then issues GET /api/v1/projects/{shareProject}/views/{view}/tasks while substituting {view} with view IDs belonging to other tenants' projects. …
Remediation Vendor-released patch: upgrade to Vikunja 2.4.0, which re-validates the requested view against the caller's authorization before loading it. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit your Vikunja deployment to identify all instances by version number and document active project share links currently in use. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vikunja

View all
CVE-2026-27575 CRITICAL POC
9.1 Feb 25

Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
CVE-2026-27616 HIGH POC
7.3 Feb 25

Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
CVE-2026-27819 HIGH POC
7.2 Feb 25

Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
CVE-2026-27116 MEDIUM POC
6.1 Feb 25

Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
CVE-2026-28268 CRITICAL
9.8 Feb 27

Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
CVE-2026-56765 CRITICAL
9.3 Jul 10

Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
CVE-2026-68581 HIGH
8.6 Aug 02

Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
CVE-2026-76216 HIGH
7.7 Aug 19

Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbit
CVE-2026-34727 HIGH
7.4 Apr 10

Authentication bypass in Vikunja task management platform allows unauthenticated attackers to circumvent two-factor auth
CVE-2026-35594 MEDIUM
6.5 Apr 10

Vikunja prior to version 2.3.0 fails to validate link share permissions against server state during JWT authentication,

CVE-2026-33335 MEDIUM
6.4 Mar 24

The Vikunja Desktop Electron application fails to validate or allowlist URI schemes before passing URLs from window.open
CVE-2026-25935 MEDIUM
5.4 Feb 11

Cross-site scripting (XSS) in Vikunja prior to version 1.1.0 allows authenticated attackers to execute arbitrary JavaScr

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-51992 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy