CVE-2026-68582: Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full createdby user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68582?
The severity of CVE-2026-68582 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-68582?
To fix CVE-2026-68582, ensure you upgrade Vikunja to the latest version beyond 2.3.0 where the vulnerability is resolved.
What does CVE-2026-68582 affect?
CVE-2026-68582 affects Vikunja versions between 0.24.0 and 2.3.0 with respect to the task-collection endpoint.
What type of vulnerability is CVE-2026-68582?
CVE-2026-68582 is classified as a broken object level authorization (BOLA) vulnerability.
Can CVE-2026-68582 lead to data exposure?
Yes, CVE-2026-68582 can potentially lead to unauthorized access to sensitive task data.