{"id":"EUVD-2026-51992","enisaUuid":"cef3b0b7-7706-3ed3-a0a9-26e4b5dc9b41","description":"Vikunja versions \u003e\u003d 0.24.0 and \u003c\u003d 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share\u0027s own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant\u0027s kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share\u0027s own project and are not disclosed. Fixed in 2.4.0.","datePublished":"Aug 2, 2026, 12:15:28 PM","dateUpdated":"Aug 3, 2026, 7:57:08 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c\nhttps://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token\n","aliases":"CVE-2026-68582\nGHSA-p4r4-8cxw-pjx7\nGHSA-rj9j-8772-4h6c\n","assigner":"VulnCheck","epss":0.33,"enisaIdProduct":[{"id":"ad34455e-6ad1-39ea-bfbf-1511b9675d26","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0.24.0 \u003c2.4.0"}],"enisaIdVendor":[{"id":"2c3cc3b2-3143-3fba-9a8c-622ab5ec8840","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"637b2d7d-50ec-380e-b95a-a0d3167b060a","vulnerability":{"id":"CVE-2026-68582","description":"Vikunja versions \u003e\u003d 0.24.0 and \u003c\u003d 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share\u0027s own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant\u0027s kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share\u0027s own project and are not disclosed. Fixed in 2.4.0.","datePublished":"Aug 2, 2026, 12:15:28 PM","dateUpdated":"Aug 3, 2026, 7:57:08 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c\nhttps://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token\n","enisa_id":"EUVD-2026-51992\n","assigner":"VulnCheck","epss":0.33,"dataProcessed":"Nov 1, 2026, 7:17:18 AM","vulnerabilityProduct":[{"id":"ef5c86d8-8ce2-3395-9c62-cf13afa96d77","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0.24.0 \u003c2.4.0"}],"vulnerabilityVendor":[{"id":"4fe13104-3887-34ed-9405-5dae3234c248","vendor":{"name":"go-vikunja"}}]}},{"id":"7883b172-5f97-3a17-ad2f-544d71af4c26","vulnerability":{"id":"GHSA-p4r4-8cxw-pjx7","description":"Duplicate Advisory: Vikunja: Link-share token reads any tenant\u0027s kanban buckets and enumerates usernames/IDs instance-wide (BOLA)","datePublished":"Aug 2, 2026, 3:30:21 PM","dateUpdated":"Oct 9, 2026, 8:42:24 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68582\nhttps://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token\n","enisa_id":"EUVD-2026-51992\n","aliases":"GHSA-p4r4-8cxw-pjx7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9d763184-b2be-3c27-a13d-25ac84ccb0b2","vulnerability":{"id":"GHSA-rj9j-8772-4h6c","description":"Vikunja: Link-share token reads any tenant\u0027s kanban buckets and enumerates usernames/IDs instance-wide (BOLA)","datePublished":"Oct 9, 2026, 8:42:33 PM","dateUpdated":"Oct 9, 2026, 8:42:33 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68582\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.4.0\nhttps://www.vulncheck.com/advisories/vikunja-broken-object-level-authorization-via-link-share-token\n","enisa_id":"EUVD-2026-51992\n","aliases":"CVE-2026-68582\nGHSA-rj9j-8772-4h6c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}