CVE-2026-55065 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api
Authenticated users can delete Kanban assignments and ordering in other projects by supplying mismatched view identifiers, leading to unauthorized data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55065?
CVE-2026-55065 is a high-severity missing authorization vulnerability in go-vikunja vikunja, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the path project, and ProjectView.Delete in pkg/models/project_view.go continues after the scoped project_views delete affects no rows. Its subsequent deletes select task_buckets and task_positions only by project_view_id, allowing cross-tenant destruction of Kanban assignments and ordering while leaving the victim view and tasks intact. This issue is fixed in version 2.4.0.
Which versions are affected by CVE-2026-55065?
3 open source packages ship an affected version, including code.vikunja.io/api.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | From 0.24.6 | None |
code.vikunja.io/api Go | From 0.24.6 | 2.4.0 |
code.vikunja.io/api Go | From 0.24.6 | 2.4.0 |
How do I fix CVE-2026-55065?
Upgrade code.vikunja.io/api to 2.4.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-55065 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55065 exists.
Sources
Also known as GHSA-gg93-x632-9ccv, GO-2026-6313.