Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
Vikunja share links expose other tenants' board lists
published 3 months ago
Summary
Versions of Vikunja from 0.24.0 through 2.3.0 let anyone who has a share link see the names of boards and user details from other organizations. The problem occurs because the system does not check that the requester is allowed to view the requested board. Updating to version 2.4.0 resolves the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Go | api | code.vikunja.io/api | >= 0.24.0, <= 2.3.0 |
Original advisory text
Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rj9j-8772-4h6c. This link is maintained to preserve external references.
### Original Description
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
This advisory has been withdrawn because it is a duplicate of GHSA-rj9j-8772-4h6c. This link is maintained to preserve external references.
### Original Description
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published2 Aug 2026
Updated9 Oct 2026
First seen9 Oct 2026
Sources
GHSA-p4r4-8cxw-pjx7 · OSV
Track software like this
Free during beta