CVE-2026-55065

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.24.6 through 2.3.x

Description An authenticated user can destroy Kanban bucket assignments and task ordering of any project view across the entire instance. This occurs because the ProjectView.Delete function in pkg/models/project view.go fails to verify that a requested view belongs to the specified project before executing cascading deletes. While the initial delete operation is scoped to both project and view identifiers, subsequent deletes for task buckets and task positions rely solely on the view identifier. An attacker can bypass authorization by providing a project identifier they control and a view identifier belonging to another user via the DELETE /api/v1/projects/:project/views/:view endpoint. This allows for cross-tenant data destruction where Kanban layouts and manual ordering are permanently lost, although the views and tasks themselves remain intact.

Recommendations Update to version 2.4.0. As a temporary mitigation, restrict access to the DELETE /api/v1/projects/:project/views/:view endpoint to trusted administrators only.