CVE-2026-55066: CWE-639: Authorization Bypass Through User-Controlled Key in go-vikunja vikunja

Vikunja versions before 2.4.0 have a flaw in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint where the task_id in the request body is used without a dedicated permission check. The authorization logic only verifies project, view, and bucket from the URL, allowing an authenticated user to enumerate and update tasks belonging to other tenants by leveraging globally sequential task IDs. This can lead to unauthorized disclosure of task contents and unauthorized modification of task completion metadata. The vulnerability is tracked as CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 score of 7.1 (high severity). It is fixed in Vikunja version 2.4.0.

An authenticated user can enumerate tasks across tenants and modify the completion status of tasks they do not own. This results in unauthorized disclosure of task details and unauthorized modification of task state, impacting confidentiality and integrity. Availability is not affected. The vulnerability does not require user interaction and has low attack complexity.

This vulnerability is fixed in Vikunja version 2.4.0. Users should upgrade to version 2.4.0 or later to remediate this issue. No vendor advisory or patch link is provided, but the fix version is explicitly stated. Until upgrading, restrict access to trusted users only.