CVE-2026-55067: Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} mass-assigns the request body’s project_view_id onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied (project, view) pair; the body’s project_view_id is never validated. Any signed-in user can therefore take one of their own buckets and graft it into any other tenant’s kanban view, with attacker-controlled title and the attacker’s account as created_by.
This vulnerability was found using an LLM, and manually verified against latest (2.3.0).
References
- github.com/advisories/GHSA-569v-q83c-3j3g
- github.com/go-vikunja/vikunja/commit/b31d606b8879ebe98fbb2ac5d8b3066b86f59868
- github.com/go-vikunja/vikunja/pull/3239
- github.com/go-vikunja/vikunja/releases/tag/v2.4.0
- github.com/go-vikunja/vikunja/security/advisories/GHSA-569v-q83c-3j3g
- nvd.nist.gov/vuln/detail/CVE-2026-55067
Code Behaviors & Features
Detect and mitigate CVE-2026-55067 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →