CVE-2026-68582 is a broken object level authorization (BOLA) vulnerability in the go-vikunja vikunja product affecting versions >=0.24.0 and <=2.3.0. The vulnerability exists in the GET /api/v1/projects/{project}/views/{view}/tasks endpoint, where the requested project view is loaded from the URL path without verifying the caller's authorization. While the task scope is limited to the share's project for link-share token holders, the view parameter is attacker-controlled and not re-validated, allowing unauthorized reading of kanban bucket titles and full created_by user objects (username, name, id) across tenants. Additionally, the missing authorization check creates a project/view-ID existence oracle via differing HTTP 404 responses. Task contents themselves remain protected and are not disclosed. The vulnerability is fixed in version 2.4.0.

An attacker with any project share link can access sensitive metadata from other tenants' project views, including kanban bucket titles and user identity information, violating tenant data isolation. This could lead to information disclosure and privacy violations. The vulnerability also allows attackers to confirm the existence of project/view IDs, potentially aiding further reconnaissance. However, actual task content data remains protected and is not exposed.

A fix for this vulnerability is available in vikunja version 2.4.0. Users should upgrade to version 2.4.0 or later to remediate this issue. Patch status is not explicitly stated beyond the fixed version, so users should consult the vendor advisory for the latest remediation guidance.