Authorization Flaw in Vikunja Task Management System from Vikunja
CVE-2026-123518

5.3MEDIUM

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123518?

Vikunja versions before 2.7.1 are affected by an authorization flaw in the TaskBucket.CanUpdate function. This vulnerability allows authenticated users with write access to multiple projects to manipulate tasks across different project kanban buckets. The flaw arises because the system does not enforce necessary checks to ensure that both the project to which a task belongs and the project's bucket to which the task is being moved are aligned. As a result, it is possible to persistently move tasks between projects, potentially violating task limit configurations and altering the state of tasks incorrectly.

Affected Version(s)

vikunja 0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.7.1...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.