CVE-2026-123503

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description An improper authorization issue exists in the canDoBucket() function. Users with project write access can delete buckets by using a mismatched view ID. By requesting deletion through a bucket endpoint belonging to a different view, an attacker can bypass the rule that prevents the deletion of the last remaining bucket. This results in inconsistent task buckets and dangling references to default or done buckets.

Recommendations Update to version 2.7.1 or later.