CVE-2026-55066: Vikunja Privilege Escalation Vulnerability

CVE-2026-55066 Overview

CVE-2026-55066 is a broken access control vulnerability [CWE-639] in Vikunja, an open-source self-hosted task management platform. Versions prior to 2.4.0 fail to authorize the task_id supplied in the request body when moving a task into a bucket. The POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint validates only the URL-scoped project, view, and bucket, but never checks whether the caller has permission to read or modify the referenced task. An authenticated user can enumerate globally sequential task identifiers to read cross-tenant task contents and toggle their completion state. Both the v1 and v2 routes share the vulnerable model.

Critical Impact
Authenticated attackers can enumerate and disclose task data belonging to other tenants and modify task completion metadata across project boundaries.

Affected Products

Vikunja versions prior to 2.4.0
Vikunja v1 API route POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks
Vikunja v2 API route sharing the TaskBucket model

Discovery Timeline

2026-08-28 - CVE-2026-55066 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55066

Vulnerability Analysis

The vulnerability resides in TaskBucket.CanUpdate inside pkg/models/kanban_task_bucket.go. The authorization check inspects only the project, view, and bucket identifiers derived from the URL path. It never validates the task_id value supplied in the request body. After passing this incomplete check, updateTaskBucket invokes Task.ReadOne, which returns the target task's contents in the response. When the attacker chooses a bucket configured as a done bucket, the task's completion state is also mutated. Because task identifiers in Vikunja are global sequential integers, an authenticated user can iterate through IDs to enumerate tasks owned by other tenants.

Root Cause

The design flaw is a missing object-level authorization check on a user-controlled body parameter. The code trusts that URL-path permissions are sufficient, but the task_id from the request body can reference any object in the database. This maps to CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

An authenticated attacker sends a crafted POST request to the vulnerable endpoint using a bucket they legitimately control. They set the body task_id to a target task ID owned by another user or tenant. The response leaks the task contents, and if the bucket is a done bucket, the target task is marked complete. Iterating through sequential IDs enables bulk cross-tenant enumeration.

 		ProjectID:     b.ProjectID,
 		ProjectViewID: b.ProjectViewID,
 	}
-	return bucket.canDoBucket(s, a)
+	canDoBucket, err := bucket.canDoBucket(s, a)
+	if err != nil || !canDoBucket {
+		return false, err
+	}
+
+	// The task comes from the request body and may live in a different
+	// project than the bucket, so it needs its own write check.
+	task := &Task{ID: b.TaskID}
+	return task.CanWrite(s, a)
 }
 
 func (b *TaskBucket) upsert(s *xorm.Session) (err error) {

Source: GitHub commit 36cdc2c. The patch adds an explicit task.CanWrite check against the body-supplied task, ensuring the caller has write permission on the referenced task and not just the destination bucket.

Detection Methods for CVE-2026-55066

Indicators of Compromise

Sequential or high-volume POST requests to /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks from a single authenticated session.
Request bodies containing task_id values that do not belong to the caller's projects.
Unexpected task completion state changes recorded in audit logs without corresponding UI activity from the task owner.

Detection Strategies

Correlate the task_id in request bodies against the authenticated user's project membership; flag mismatches.
Alert on rapid, monotonically increasing task_id values in POST bodies indicating enumeration behavior.
Review reverse-proxy or application logs for the v1 and v2 bucket-task routes for anomalous request rates.

Monitoring Recommendations

Enable verbose application logging on Vikunja API endpoints and forward to a centralized log platform.
Track completion state transitions and cross-reference with the authenticated user performing the change.
Baseline normal task-move activity per user and alert on deviations.

How to Mitigate CVE-2026-55066

Immediate Actions Required

Upgrade Vikunja to version 2.4.0 or later, which includes the fix in pkg/models/kanban_task_bucket.go.
Audit historical logs for suspicious POST requests to bucket task endpoints referencing non-owned task_id values.
Rotate API tokens for any accounts suspected of abuse and notify affected tenants.

Patch Information

The fix is available in Vikunja v2.4.0. The patch is tracked in Pull Request #3239 and commit 36cdc2c. See the GHSA-5pg6-m483-7vrg advisory for the full disclosure.

Workarounds

Restrict access to the Vikunja instance to trusted authenticated users until the patch is applied.
Place the API behind a reverse proxy that inspects and filters requests to bucket task endpoints where the body task_id does not match the caller's authorized projects.
Disable multi-tenant self-registration to reduce the pool of accounts capable of exploiting the flaw.

bash

# Upgrade Vikunja using Docker
docker pull vikunja/vikunja:2.4.0
docker stop vikunja && docker rm vikunja
docker run -d --name vikunja -p 3456:3456 -v vikunja-data:/app/vikunja/files vikunja/vikunja:2.4.0