CVE-2026-55067

Received Received - Intake

Vulnerability in Vikunja Allows Bucket Relocation via Mass Assignment

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to the URL project and view but does not validate the body selected destination view, allowing any authenticated user to relocate an attacker-owned bucket into another tenant’s Kanban view. The injected bucket retains attacker-controlled content and ownership, enabling cross-tenant defacement. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55067

EUVD

EUVD-2026-67834

Affected Vendors & Products

Vendor	Product	Version / Range
vikunja	vikunja	to 2.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-55067 is a mass-assignment vulnerability in Vikunja, an open-source task management platform. It allows authenticated users to relocate buckets across different tenants by modifying the project_view_id field. The issue occurs because the Bucket.Update function does not validate the destination view, enabling attackers to move their buckets into other users' Kanban views. This results in cross-tenant defacement where attacker-controlled content appears in victims' views.

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a version prior to 2.4.0. Use the command: curl -s https://your-vikunja-instance.com/api/version | grep version. If the version is less than 2.4.0, the system is vulnerable.

Impact Analysis

If you use Vikunja versions before 2.4.0, an attacker with a valid account could move their buckets into your Kanban views. This allows them to display unauthorized or malicious content in your interface, potentially causing confusion, misinformation, or reputational damage. The impact is limited to visual defacement as the attacker retains ownership of the bucket.

Mitigation Strategies

Upgrade Vikunja to version 2.4.0 or later immediately. If upgrading is not possible, restrict access to authenticated users only and monitor for unauthorized bucket movements in kanban views.

Hi! I’m here to help you understand CVE-2026-55067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70