Incorrect Authorization in Vikunja Allows Cross-Project Task Manipulation

Executive Summary

Vikunja before 2.7.1 has a missing authorization vulnerability in the Kanban task-bucket move functionality. The TaskBucket.CanUpdate function checks write access to the bucket's project and the task separately but fails to verify if both belong to the same project. This allows authenticated users with write access to two different projects to move a task into another project's kanban bucket, creating cross-project task_buckets entries.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a version prior to 2.7.1. Use commands like 'curl -s https://your-vikunja-instance.com/api/version' or inspect the version in the web interface. Additionally, review logs for cross-project task movements or unauthorized bucket modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker could move tasks between projects they have access to, bypassing project isolation. This may cause tasks to become invisible in the destination project's view while still counting toward bucket limits. If moved to a done bucket, the task's done state may be toggled and date fields altered.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later immediately. If upgrading is not possible, restrict write access to projects and monitor for suspicious task movements between projects. Implement project-membership checks for task-bucket moves as a temporary workaround.

Useful 0 Not Useful 0