CVE-2026-68582

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.24.0 through 2.3.0

Description A broken object level authorization (BOLA) issue exists in the task-collection endpoint 'GET /api/v1/projects/{project}/views/{view}/tasks'. The system loads the project view from the URL path without verifying if the caller is authorized to access it. For users holding a link-share token, while the task scope is limited to the shared project, the view is retrieved from the attacker-controlled path without re-validation. This allows a link-share token holder to read kanban bucket records from any tenant in the instance, including bucket titles and the created by user object containing username, name, and id. Additionally, the lack of pre-authorization creates an existence oracle for project and view IDs, allowing authenticated users and link-share holders to determine if specific IDs exist based on the server response (404 vs. non-404). Task contents are not disclosed.

Recommendations Update to version 2.4.0.