Improper Authorization in Vikunja Allows Bucket Deletion

Executive Summary

Vikunja before version 2.7.1 has an improper authorization flaw in the Kanban bucket deletion feature. Users with project write access can delete buckets by exploiting a mismatched view ID. They send deletion requests through another view's bucket endpoint, bypassing the last-bucket rule. This leaves default or done buckets with invalid references and causes inconsistent task buckets.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a version prior to 2.7.1. Use commands like 'curl -s https://your-vikunja-instance.com/api/version' or inspect the version in the web interface. If the version is below 2.7.1, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with project write access to delete buckets, disrupting project organization. It can cause data inconsistency by leaving dangling references in default or done buckets and may affect task assignments. However, it is limited to the same project and does not allow cross-project access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Vikunja to version 2.7.1 or later to patch the improper authorization flaw. Ensure no users have write access to projects unless necessary. Review project bucket configurations for inconsistencies after upgrading.

Useful 0 Not Useful 0