Api: Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
Description
Vikunja versions up to 2.5.0 contain a vulnerability where the project_view_id parameter in task-position API requests is not validated to ensure it belongs to the task's project. This allows authenticated users to inject task position rows into project views of other tenants. The issue affects both v1 and v2 task-position endpoints. The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact confidentiality or availability but can affect data integrity. This advisory is a duplicate of GHSA-w39f-h553-h2mx and has been withdrawn to preserve references.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Vikunja before version 2.6.0 fails to validate that the user-supplied project_view_id in task-position API requests belongs to the task's project. Authenticated attackers can exploit this by sending POST or PUT requests to the task-position endpoints (v1 and v2) to insert task position rows into arbitrary project views belonging to other tenants. This cross-tenant injection can lead to unauthorized manipulation of task positions in projects outside the attacker's scope. The vulnerability is identified as CWE-639 (Authorization Bypass Through User-Controlled Key).
Potential Impact
The vulnerability allows authenticated users to manipulate task position data in project views of other tenants, potentially causing unauthorized data integrity issues. There is no impact on confidentiality or availability. No known exploits are reported in the wild.
Mitigation Recommendations
A fix is available in Vikunja version 2.6.0 and later. Users should upgrade to version 2.6.0 or newer to remediate this vulnerability. Since this advisory is a duplicate and withdrawn, refer to the original advisory GHSA-w39f-h553-h2mx for detailed remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ccgq-fx7h-2v4c
- Osv Schema Version
- 1.4.0
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac96e4c2cdf04f65689a6c2
Added to database: 10/09/2026, 22:44:28 UTC
Last enriched: 10/09/2026, 22:48:45 UTC
Last updated: 10/09/2026, 22:48:45 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.