CVE-2026-123518

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description An incorrect authorization issue exists in the TaskBucket.CanUpdate() function. The system verifies write access to the bucket's project and the task independently but fails to confirm that both belong to the same project. Consequently, authenticated users with write access to two different projects can move a task into a kanban bucket of another project. This action creates cross-project task buckets rows that impact bucket limits and can toggle the done state of a task when using done buckets.

Recommendations Update to version 2.7.1.