CVE-2026-55067: Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} mass-assigns the request body’s project_view_id onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied (project, view) pair; the body’s project_view_id is never validated. Any signed-in user can therefore take one of their own buckets and graft it into any other tenant’s kanban view, with attacker-controlled title and the attacker’s account as created_by.
This vulnerability was found using an LLM, and manually verified against latest (2.3.0).
References
- github.com/advisories/GHSA-569v-q83c-3j3g
- github.com/go-vikunja/vikunja/commit/b31d606b8879ebe98fbb2ac5d8b3066b86f59868
- github.com/go-vikunja/vikunja/pull/3239
- github.com/go-vikunja/vikunja/releases/tag/v2.4.0
- github.com/go-vikunja/vikunja/security/advisories/GHSA-569v-q83c-3j3g
- nvd.nist.gov/vuln/detail/CVE-2026-55067
Code Behaviors & Features
Detect and mitigate CVE-2026-55067 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →