CVE-2026-54766: Vikunja has a project duplication bypasses write-permission check on the target parent project

The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated (non-link-share) user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an attacker-owned project into another user’s or team’s project hierarchy.