PT-2026-92098 · Vikunja · Vikunja
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Vikunja versions prior to 2.6.0
Description
Authenticated attackers can insert task position rows into project views belonging to other tenants. This occurs because the application fails to validate that the user-supplied
project view id in task-position requests belongs to the project associated with the task. The issue affects the POST and PUT task-position endpoints.Recommendations
Update to version 2.6.0 or later.
Exploit
Fix
Incorrect Authorization
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vikunja