{"id":"CVE-2026-68582","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-02T13:16:54.233","lastModified":"2026-10-23T22:10:00.160","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0."},{"lang":"es","value":"Las versiones de Vikunja >= 0.24.0 y menor o igual que 2.3.0 contienen una vulnerabilidad de autorización a nivel de objeto rota (BOLA) en el endpoint de recolección de tareas (GET /API/v1/projects/{project}/views/{view}/tasks). El endpoint carga la vista de proyecto solicitada desde la ruta URL sin verificar que el llamador esté autorizado para ello. Para un poseedor de token de enlace compartido, el alcance de la tarea está fijado al propio proyecto del recurso compartido, pero la vista se toma de la ruta controlada por el atacante y nunca se revalida. Como resultado, un poseedor de cualquier enlace de proyecto compartido puede leer los registros de cubos kanban de cualquier otro inquilino - títulos de cubo y el objeto de usuario completo created_by (nombre de usuario, nombre, id) - para cada vista en la instancia. La misma carga de vista de pre-autorización faltante también crea un oráculo de existencia de ID de proyecto/vista (404 vs. no-404) utilizable por enlaces compartidos y usuarios autenticados ordinarios. Los contenidos de las tareas permanecen restringidos al propio proyecto del recurso compartido y no se divulgan. Corregido en 2.4.0."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"go-vikunja","product":"vikunja","defaultStatus":"unaffected","packageURL":"pkg:golang/code.vikunja.io/api","versions":[{"version":"0.24.0","lessThan":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-03T19:56:15.850224Z","id":"CVE-2026-68582","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token","source":"disclosure@vulncheck.com"},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}