Vikunja Task Management App Patched for Critical IDOR Vulnerability

The Vikunja task management application released version 2.4.0 to address a critical authentication bypass vulnerability that allowed attackers to access private project data. The flaw, tracked as CVE-2026-68582, existed in the API endpoint responsible for retrieving task collections.

According to the GitHub advisory GHSA-rj9j-8772-4h6c, the issue stemmed from how the application handled view identifiers in URL paths. When a user accessed the `GET /api/v1/projects/{project}/views/{view}/tasks` endpoint using a link-share token, the system correctly restricted the task scope to the project associated with that token. However, it failed to validate whether the specific view ID provided in the URL belonged to that same project. This mismatch allowed an attacker holding a share link to any project to substitute the view parameter with an ID from a different tenant’s kanban board.

Technical Details

The root cause was identified in the `TaskCollection.ReadAll` function within `pkg/models/task_collection.go`. The code resolved the view from URL parameters before performing any permission checks. It called `GetProjectViewByIDAndProject`, which filtered records based on ID and project ID but performed no authorization verification.

For callers using a link-share token, the application pinned the task scope to the token’s project but reused the attacker-supplied view object. Because this foreign view was never validated against the share’s project ID, the system returned data from the unauthorized view. This exposure included bucket titles and the full `created_by` user object, which contained usernames, names, and user IDs for every view in the instance.

Additionally, the missing pre-authorization created an existence oracle. Both link-share holders and ordinary authenticated users could determine whether specific project or view IDs existed by observing whether the server returned a 404 error or a successful response. This information could be used to enumerate valid IDs for further exploitation.

Who Is Affected

The vulnerability affects all installations of Vikunja running versions 0.24.0 through 2.3.0. Users on these versions are vulnerable to information disclosure and potential enumeration attacks if they utilize the link-share feature. The fix is included in version 2.4.0, which validates that the requested view belongs to the project associated with the authentication token.

What should you do?

Administrators running Vikunja should verify their current version and upgrade to 2.4.0 immediately. Until an update is applied, organizations should restrict the use of link-share tokens to sensitive projects. Monitor API logs for unusual access patterns, particularly requests that combine valid share tokens with view IDs belonging to different projects.