CVE-2026-55067: CWE-639: Authorization Bypass Through User-Controlled Key in go-vikunja vikunja

Vikunja versions prior to 2.4.0 contain an authorization bypass vulnerability (CWE-639) in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} endpoint. The request body parameter project_view_id is mass assigned without proper validation of the destination view. While the permission check confirms the bucket belongs to the URL project and view, it does not verify the selected destination view in the request body. This flaw allows any authenticated user to relocate a bucket they control into another tenant's Kanban view, preserving attacker ownership and content, resulting in cross-tenant defacement. The issue is resolved in version 2.4.0.

An authenticated user can bypass authorization controls to move attacker-controlled buckets into other tenants' Kanban views. This enables cross-tenant defacement by injecting content controlled by the attacker into another tenant's workspace. There is no impact on confidentiality or availability reported. The vulnerability has a CVSS 3.1 score of 5.0 (medium severity).

This vulnerability is fixed in Vikunja version 2.4.0. Users should upgrade to version 2.4.0 or later to remediate this issue. No official patch or temporary fix is documented beyond upgrading. Since this is a self-hosted product, administrators must apply the update themselves.