GHSA-569v-q83c-3j3g: Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
Summary
Vikunja (a project management tool) has a vulnerability where any logged-in user can move another user's kanban bucket (a column in a task board) into a different user's project by sending a specially crafted API request. The problem is that the permission check only validates that the bucket belongs to the attacker's own view, but doesn't verify that the `project_view_id` field (which specifies which view the bucket should belong to) is legitimate, allowing attackers to inject buckets into victims' kanban views for defacement.
Solution / Mitigation
In the `(b *Bucket) Update` function in `pkg/models/kanban.go`, remove `project_view_id` from the `Cols(...)` allowlist (which controls which fields can be mass-assigned from the request body) and reject any request where the body's `project_view_id` differs from the bucket's existing `ProjectViewID`. Alternatively, if moving buckets between views is a legitimate feature, create a separate dedicated endpoint that validates permission checks against both the source and destination views.
Vulnerability Details
EPSS: 0.0%
Yes
August 28, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-569v-q83c-3j3g
First tracked: August 28, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 95%