CVE-2026-54766: CWE-285: Improper Authorization in go-vikunja vikunja

The vulnerability in go-vikunja vikunja (CVE-2026-54766) involves improper authorization in the project duplication functionality. Specifically, the ProjectDuplicate.CanCreate method calls parent.CanCreate on an unhydrated Project object identified only by the parent_project_id, rather than calling parent.CanWrite. This omission causes the permission check for write access on the target parent project to be skipped during the duplication process. While the standard project creation path enforces write permissions, the PUT /api/v1/projects/{project}/duplicate endpoint does not, allowing an authenticated user with read access to duplicate a project beneath any target parent project, potentially injecting unauthorized content into another user's or team's project hierarchy. The vulnerability affects versions from 0.21.0 until 2.4.0 and is resolved in version 2.4.0.

An authenticated user with read access to a source project can bypass write permission checks on the target parent project during duplication. This allows the attacker to place duplicated projects under arbitrary parent projects they do not have write access to, potentially injecting unauthorized content into other users' or teams' project hierarchies. This could lead to unauthorized data manipulation or confusion in project organization but does not directly allow privilege escalation or data disclosure beyond the duplication scope.

This vulnerability is fixed in go-vikunja vikunja version 2.4.0. Users should upgrade to version 2.4.0 or later to ensure the proper write-permission checks are enforced during project duplication. Patch status is not explicitly stated beyond the fix in 2.4.0, so users should verify with the vendor advisory for the latest remediation guidance.