CVE-2026-55067

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.4.0

Description An issue exists where the project view id value in the request body can be mass assigned via the Bucket.Update() function in pkg/models/kanban.go. While the system validates that the bucket belongs to the project and view specified in the URL, it fails to validate the destination view provided in the request body. This allows any authenticated user to relocate a bucket they own into another tenant's Kanban view. Because the injected bucket retains the attacker's controlled content and ownership, this can lead to cross-tenant defacement. The affected API endpoint is 'POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}' and the vulnerable variable is project view id.

Recommendations Update to version 2.4.0. As a temporary mitigation, restrict the use of the 'POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}' endpoint to trusted users only.