Threats tagged 'ghsa-c9v9-9g94-ghgc'

Vikunja versions prior to 2.7.1 have an authorization vulnerability in the TaskBucket.CanUpdate function. The flaw allows authenticated users with write access to two different projects to move a task from one project's kanban bucket to another without proper verification that both buckets belong to the same project. This can cause tasks to persist across projects incorrectly, affecting bucket limits and toggling the task's done state in done buckets.