CVE-2026-55064

Name of the Vulnerable Software and Affected Versions Vikunja versions 2.3.0 through 2.3.0-246-9852aff4

Description A user with Write but not Admin permissions on a shared child project can detach that project from its parent hierarchy. This is possible by submitting a parent project id value of 0 to the POST '/api/v1/projects/{project}' endpoint. The issue occurs because the authorization check in Project.CanUpdate() (within pkg/models/project permissions.go) and the logic in UpdateProject() (within pkg/models/project.go) only validate non-zero parent values. Since UpdateProject() always persists the parent project id variable, an explicit zero value bypasses the Admin requirement. This action severs the recursive Common Table Expression (CTE) permission-inheritance chain—a method used to determine access rights by traversing the project hierarchy upward—which can disrupt the owner's organizational structure and cause other collaborators to lose inherited access.

Recommendations Update to version 2.4.0.