CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123518?
CVE-2026-123518 is a medium-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.
Official description
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state.
Weakness: CWE-639
Which versions are affected by CVE-2026-123518?
How do I fix CVE-2026-123518?
No fix has been published for CVE-2026-123518 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123518 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123518 exists.
Sources
Also known as GHSA-c9v9-9g94-ghgc, GHSA-w64q-7p4m-j8g8.