CVE-2026-54766

Received Received - Intake

Vulnerable Project Duplication in Vikunja

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project. ProjectDuplicate.CanCreate calls parent.CanCreate on an unhydrated Project containing only the body supplied parent_project_id instead of calling parent.CanWrite, so the target parent write-permission check is skipped. The ordinary project creation path enforces that permission, but PUT /api/v1/projects/{project}/duplicate does not, allowing attacker-owned content to be injected into another user or team project hierarchy. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-54766

EUVD

EUVD-2026-67830

Affected Vendors & Products

Vendor	Product	Version / Range
vikunja	vikunja	From 0.21.0 (inc) to 2.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-54766 is a vulnerability in Vikunja, an open-source task management platform. It allows an authenticated user to duplicate a project they can read and attach it as a child to any parent project, even if they lack write permissions for that parent. This occurs due to incorrect permission checks in the project duplication function, which skips write-permission validation. The flaw affects versions 0.21.0 through 2.3.0.

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a vulnerable version (0.21.0 to 2.3.0). Review project duplication logs for unauthorized project placements under parent projects where the user lacks write permissions. Inspect the CanCreate function in pkg/models/project_duplicate.go for incorrect use of parent.CanCreate instead of parent.CanWrite.

Impact Analysis

This vulnerability could allow attackers to inject unauthorized projects into other users' or teams' project hierarchies. It compromises data integrity and access control, enabling attackers to place their content within restricted project structures. The impact includes unauthorized modifications to project organization and potential exposure of sensitive data.

Compliance Impact

This vulnerability could lead to violations of compliance standards like GDPR and HIPAA by enabling unauthorized access to or modification of project hierarchies containing sensitive data. It undermines access control mechanisms, which are critical for maintaining data confidentiality and integrity under these regulations.

Mitigation Strategies

Immediately upgrade Vikunja to version 2.4.0 or later to apply the security fix. Ensure the CanCreate function in pkg/models/project_duplicate.go uses parent.CanWrite for permission checks. Review and remove any unauthorized project placements in user or team hierarchies.

Hi! I’m here to help you understand CVE-2026-54766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70