The vulnerability in Vikunja (CVE-2026-68582) affects versions >=0.24.0 and <=2.3.0. The task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks) loads the requested project view from the URL path without verifying authorization. While link-share tokens restrict task scope to their own project, the view parameter is attacker-controlled and not re-validated, allowing unauthorized reading of other tenants' kanban bucket titles and full created_by user objects (username, name, id). Additionally, the missing pre-authorization check creates a project/view-ID existence oracle via differing 404 responses. Task contents themselves are not disclosed. The issue was fixed in version 2.4.0.

An attacker with any project share link can access sensitive metadata from other tenants, including kanban bucket titles and user identity information, across all views in the instance. This leads to unauthorized information disclosure. However, actual task content remains protected and is not exposed. The vulnerability also allows attackers to confirm the existence of project/view IDs, which could aid further reconnaissance.

A fix is available in Vikunja version 2.4.0. Users should upgrade to version 2.4.0 or later to remediate this vulnerability. No vendor advisory is provided here, so patch status is based on the description stating the issue is fixed in 2.4.0.