CVE-2026-55064: CWE-862: Missing Authorization in go-vikunja vikunja

Vikunja, an open-source task management platform, contains a missing authorization vulnerability (CWE-862) in versions 2.3.0 through 2.3.x where a user with Write permission on a shared child project can detach it from its parent project by submitting a parent_project_id value of zero to the POST /api/v1/projects/{project} endpoint. The authorization check (Project.CanUpdate) only validates nonzero parent_project_id values, allowing the zero value to bypass the Admin permission requirement introduced in a prior fix (CVE-2026-35595). This detachment breaks the recursive permission inheritance, potentially disrupting the project hierarchy and inherited collaborator access. The vulnerability is resolved in version 2.4.0.

Exploitation allows a user with Write but not Admin permissions to detach a child project from its parent, severing the recursive permission inheritance chain. This can disrupt the project hierarchy and inherited collaborator access, potentially impacting project management and collaboration integrity. There is no direct confidentiality or availability impact reported.

This vulnerability is fixed in Vikunja version 2.4.0. Users should upgrade to version 2.4.0 or later to remediate this issue. Patch status is not explicitly confirmed beyond the fix in 2.4.0; therefore, verify with the vendor advisory for current remediation guidance.