CVE-2026-55064

Received Received - Intake

Project Detachment via Zero Parent ID in Vikunja

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner’s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55064

EUVD

EUVD-2026-67831

Affected Vendors & Products

Vendor	Product	Version / Range
vikunja	vikunja	to 2.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Vikunja allows a user with Write but not Admin permission to detach a shared child project from its parent by setting parent_project_id to 0. This bypasses an earlier fix (CVE-2026-35595) that required Admin permissions for reparenting. The issue occurs because the system cannot distinguish between an omitted parent_project_id and an explicit zero value, allowing unauthorized users to disrupt project hierarchies and inherited permissions.

Detection Guidance

To detect this vulnerability, check Vikunja server logs for unauthorized project detachment attempts. Look for POST requests to /api/v1/projects/{project} with parent_project_id set to 0 by non-admin users. Verify if any shared child projects were detached from their parent hierarchy without proper authorization.

Impact Analysis

An attacker with Write permissions could detach projects from their parent hierarchies, disrupting the owner's project structure and inherited collaborator access. This could lead to unauthorized changes in project permissions or loss of access control, potentially affecting task management and collaboration workflows.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized users to alter project hierarchies and permissions, potentially violating data access controls required by GDPR or HIPAA. Disruption of inherited permissions may lead to unauthorized data exposure or loss of audit trails, increasing regulatory risk.

Mitigation Strategies

Upgrade Vikunja to version 2.4.0 or later to apply the security fix. If immediate upgrade is not possible, restrict write permissions for non-admin users on shared projects until patched. Monitor project hierarchies for unauthorized changes and review logs for suspicious detachment activities.

Hi! I’m here to help you understand CVE-2026-55064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70