CVE-2026-68582
Received Received - Intake

Broken Object Level Authorization in Vikunja

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: VulnCheck

Description
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-68582
EUVD
EUVD-2026-51992

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja From 0.24.0 (inc) to 2.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja versions between 0.24.0 and 2.3.0 have a broken object level authorization (BOLA) vulnerability in the task-collection endpoint. The endpoint fails to verify if the caller is authorized to access the requested project view, allowing unauthorized access to kanban bucket records across different tenants.

Impact Analysis

An attacker with a project share link can read bucket titles and user details (username, name, id) for all views in the instance, even for other tenants. This exposes sensitive project metadata and user information without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating privacy and security requirements under GDPR and HIPAA. It risks non-compliance due to potential breaches of personal and sensitive data access controls.

Mitigation Strategies

Upgrade Vikunja to version 2.4.0 or later to fix the BOLA vulnerability in the task-collection endpoint. Ensure all project share links are reviewed for unauthorized access and restrict permissions accordingly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart