CVE-2026-55066

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.4.0

Description An authenticated user can enumerate tasks across different tenants and modify their completion metadata. This occurs because the endpoint "/api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks" accepts a task id in the request body, but the TaskBucket.CanUpdate function in pkg/models/kanban task bucket.go only authorizes the project, view, and bucket specified in the URL. Subsequently, the updateTaskBucket function calls Task.ReadOne without performing a separate permission check on the task, allowing the return of task contents and the modification of the task's done state if a done bucket is selected. This behavior affects both v1 and v2 routes that share this model due to task identifiers being global sequential values.

Recommendations Update to version 2.4.0.