Authorization Flaw in Vikunja Task Management Platform

CVE-2026-55065

What is CVE-2026-55065?

Vikunja, an open-source self-hosted task management platform, has a vulnerability that allows authenticated users to exploit the system by leveraging inadequate authorization checks. Specifically, the vulnerability manifests in the DELETE operation on project views, where the platform fails to ensure that the view identifier matches the intended project. This oversight enables attackers to unknowingly target views from other projects, leading to potential disruptions in task management and organization. The flaw affects versions 0.24.6 through 2.4.0 but has since been addressed in version 2.4.0, emphasizing the necessity for users to update to secure their environments.

References