CVE-2026-55066

Received Received - Intake

Stored Task Completion Modification in Vikunja

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55066

EUVD

EUVD-2026-67833

Affected Vendors & Products

Vendor	Product	Version / Range
vikunja	vikunja	2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-55066 is an Insecure Direct Object Reference (IDOR) vulnerability in Vikunja, a self-hosted task management platform. It allows authenticated users to manipulate task IDs in API requests to access or modify tasks belonging to other users or organizations. The issue occurs because the endpoint only checks permissions for the project, view, or bucket in the URL but not the task ID in the request body. Task IDs are global and sequential, enabling enumeration and unauthorized access.

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a version prior to 2.4.0. Review API logs for unusual POST requests to /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks with task_id parameters. Monitor for unauthorized task modifications or data exfiltration attempts.

Impact Analysis

An attacker could read sensitive task details such as titles, descriptions, assignees, labels, and attachments. They could also modify a task's completion status or due dates, potentially disrupting workflows or causing data integrity issues. Since task IDs are global, any authenticated user can exploit this to access tasks across different projects or organizations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive task data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Unauthorized modifications to task data may also breach integrity controls. Organizations using affected Vikunja versions must address this to maintain compliance with data protection regulations.

Mitigation Strategies

Immediately upgrade Vikunja to version 2.4.0 or later. If upgrading is not possible, restrict access to the vulnerable endpoints via network controls or application-level firewalls. Review all task modifications for suspicious activity and audit user permissions.

Hi! I’m here to help you understand CVE-2026-55066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70