THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-5pg6-m483-7vrg (high) — Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

[GHSA] GHSA-5pg6-m483-7vrg (high) — Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

medgithub_advisoriesPublished 2026-08-28

GHSA-5pg6-m483-7vrg Severity: high CVE: CVE-2026-55066

Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

## Summary

The kanban endpoint `POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks` moves a task into a bucket. The task is identified by `task_id` in the **request body**. The endpoint's authorization check (`TaskBucket.CanUpdate`) onl

Indicators of compromise

CVE-2026-55066cve
CVE-2026-33676cve
CVE-2026-33678cve
CVE-2026-33313cve
CVE-2026-35598cve

Original source: https://github.com/advisories/GHSA-5pg6-m483-7vrg