CVE-2026-123518 Details
Description
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state.
A vulnerability exists in Vikunja versions prior to 2.7.1, where the authorization process for moving tasks between kanban buckets does not properly ensure that tasks and buckets belong to the same project. This flaw allows authenticated users with write access to two different projects to transfer tasks into another project's kanban bucket. The vulnerability arises because the system checks write permissions for tasks and buckets separately, without verifying that they are linked to the same project. As a result, tasks can be moved across projects, disrupting project-specific task management and kanban state.
Users can update to Vikunja version 2.7.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w64q-7p4m-j8g8 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vikunja-before-2.7.1-missing-authorization-in-kanban-task-bucket-move | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | <= 2.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |