Task Management Platform Vulnerability in Vikunja by Go Vikunja

CVE-2026-55066

What is CVE-2026-55066?

Vikunja, an open-source self-hosted task management platform, has a vulnerability that stems from inadequate authorization controls. Specifically, prior to version 2.4.0, the API endpoint for updating tasks in project-specific views could be exploited by attackers. The issue lies in the fact that while the endpoint accepts a task_id parameter, the authorization logic fails to verify if the authenticated user has the right permissions to access or modify the task. Consequently, an attacker could exploit this flaw to enumerate tasks across different tenants and alter the state, including marking tasks as completed. This vulnerability highlights the need for robust access control measures to ensure that users can only interact with their own data. The issue was resolved in version 2.4.0, which introduced improved permission checks.

References