CVE-2026-55065

Executive Summary

CVE-2026-55065 is an improper authorization vulnerability (CWE-285) in Vikunja, an open-source self-hosted task management platform. An authenticated attacker can exploit a cross-tenant authorization flaw in the project view deletion API endpoint to destroy Kanban board column assignments and task ordering data belonging to other users or projects, while leaving the victim's view configuration and tasks intact. The vulnerability affects versions 0.24.6 through 2.4.0 and has been fixed in version 2.4.0; however, no patch evidence from any tracked source has been confirmed (patch confidence 0/4). The vulnerability carries a CVSS score of 8.1 (High), reflecting its remote exploitability with low privileges and significant integrity/availability impact on victim data.

Technical Analysis

The vulnerability exists in the Vikunja deletion API endpoint DELETE /api/v1/projects/:project/views/:view. The flaw lies in an improper authorization check that permits an authenticated user to supply a view identifier belonging to a different project while authorizing the request only against an attacker-controlled project identifier.

The code-level issue is documented across two files explicitly named in the NVD description:

1. pkg/models/project_view_permissions.go — The ProjectView.CanDelete method does not establish that the view identifier in the request path actually belongs to the project identifier in the same path. This constitutes an authorization validation gap where the system fails to verify the ownership relationship between the two path parameters before permitting the deletion operation.

2. pkg/models/project_view.go — The ProjectView.Delete method continues execution even after the scoped project_views delete operation affects zero rows. This means the function does not short-circuit when the primary deletion target (the view itself) is not found or not owned by the authenticated user's project. Instead, execution proceeds to subsequent delete operations that target task_buckets and task_positions tables.

The critical failure is that these subsequent delete operations select rows only by project_view_id — not by a composite key that includes the project ownership context. As a result, an attacker can supply a project_view_id belonging to another tenant's project, and the subsequent delete operations will remove Kanban column assignments (task_buckets) and task ordering data (task_positions) belonging to that victim view.

Importantly, the victim's view configuration and tasks themselves remain intact — only the bucket assignments and positional ordering data are destroyed. This creates a "silent data corruption" scenario where Kanban boards lose their column structure assignments and tasks may appear in unexpected or lost ordering, without obvious sign of a destructive event.

The attack surface is the Vikunja REST API, which is typically exposed to authenticated users. The vulnerability requires only low-privilege authentication (CVSS PR:L), making it accessible to any legitimate user account on the platform. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N).

Exploitation Scenarios

The attack chain for CVE-2026-55065 proceeds as follows:

1) Reconnaissance / Target Identification: An authenticated attacker enumerates or discovers project_view_id values belonging to other projects within the Vikunja instance. This can be done by observing API responses from shared boards, collaborating with users who share views, or probing sequential/high-value identifiers. Vikunja is a collaboration platform, so cross-tenant visibility of view identifiers may be common in multi-user deployments.

2) Triggering the Flaw: The attacker crafts a DELETE request to DELETE /api/v1/projects/:project/views/:view where:

• :project is set to a project the attacker controls or has authorization for.
• :view is set to a project_view_id belonging to the victim's project.

The authorization check (ProjectView.CanDelete) validates only that the attacker has delete rights on the attacker-controlled project — not that the view belongs to that project. The request passes authorization.

3) Payload/Execution Method: The request body or path parameters contain the victim's view identifier. Upon execution, ProjectView.Delete runs its first delete against project_views scoped to the project — this affects zero rows because the victim's view belongs to a different project. However, the function does not terminate; it proceeds to delete rows from task_buckets and task_positions tables where project_view_id matches the victim's view identifier. These deletes succeed because they are not scoped by project ownership.

4) Post-Exploitation Impact: The victim's Kanban board loses all column (bucket) assignments and task ordering/positioning data. The view itself and tasks remain, but the board layout is destroyed — tasks may appear in a default/collapsed state, columns disappear, and ordering is reset. This is a destructive integrity and availability attack that can be repeated against multiple views across tenants. The attack is silent: no error is returned to the attacker (since subsequent deletes succeed), and the victim may not immediately notice the data loss.

Inferred attack chain (no public PoC available). The attack is executed via the Vikunja REST API over HTTPS. No public proof-of-concept exists, and this attack chain is inferred from the NVD description and vulnerability class characteristics.

Proof of Concept Intelligence

No public proof-of-concept is currently available for this vulnerability. However:

1) Why exploitation may still be possible: The vulnerability exists in a relatively complex authorization logic path involving delete operations across multiple database tables. The code pattern described — where a delete function continues after affecting zero rows and subsequently performs unscoped deletes by foreign key — is a common class of logic flaw that can be trivially exploited once understood. An attacker with API access and the ability to enumerate view identifiers can likely craft the exploit with minimal reverse engineering. The lack of a published PoC does not indicate the vulnerability is unexploitable; rather, it suggests the information is not yet public or is being held.

2) What defenders should monitor: Security teams should monitor the following resources for future PoC disclosure and exploitation activity:

• Vikunja's official GitHub repository (issues, discussions, and security advisories)
• NVD and CVE feeds for updates to this CVE record
• ExploitDB, GitHub code search, and public exploit aggregation sites
• Vikunja community forums and self-hosting communities (Reddit r/selfhosted, Hacker News)
• Any vendor security advisories or patch announcements referencing version 2.4.0

Defenders should also monitor their own web server logs for anomalous DELETE requests to /api/v1/projects/*/views/* from authenticated sessions, particularly where view identifiers appear to change between requests while project identifiers remain constant.

Impact Assessment

CVSS Breakdown (based on vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H):

• Attack Vector (AV:N): Network-exposed — Vikunja instances are web servers accessible over the network.
• Attack Complexity (AC:L): Low — no special conditions beyond valid authentication are required.
• Privileges Required (PR:L): Low — only a standard authenticated user account is needed.
• User Interaction (UI:N): None — no victim interaction required.
• Scope (S:U): Unchanged — the impact is confined to the vulnerable component's security scope.
• Confidentiality (C:N): None — no data disclosure.
• Integrity (I:H): High — Kanban assignments and ordering data are destroyed or corrupted.
• Availability (A:H): High — the victim's board layout and operational data are rendered unusable/reset.

Business Impact: The primary impact is data integrity loss and service degradation. Organizations using Vikunja for task management rely on Kanban board structure to organize workflows; destroying column assignments and ordering can halt operations, confuse team members, and require manual restoration of data. Because the view and tasks remain intact but their organization is lost, the recovery process is non-trivial: administrators must manually recreate bucket assignments and reorder tasks. In multi-tenant deployments (e.g., a Vikunja instance serving multiple teams or external clients), a single low-privileged user can systematically destroy data across all tenants.

Affected Systems: All Vikunja instances running versions 0.24.6 through 2.4.0 are affected. This includes self-hosted deployments, Docker container installations, and any managed instances running these versions.

Blast Radius: The vulnerability is tenant-scoped in that each exploitation attempt targets a single project_view_id. However, the attack can be repeated across multiple view IDs, enabling enumeration and mass destruction across all projects on the instance. The lack of rate limiting or detection mechanism may allow a single attacker to destroy hours of organizational Kanban data across an entire deployment in a short time.

Detection Guidance

Below are detection rules for monitoring exploitation attempts and related activity. Each rule targets anomalous API behavior consistent with this vulnerability.

Sigma Rule

title: Vikunja DELETE Project View - Potential Authorization Bypass (CVE-2026-55065)
id: 9f2c3a51-7b5e-4d8a-9f0c-1a2b3c4d5e6f
status: experimental
description: Detects anomalous DELETE requests to Vikunja project view API endpoints where view identifiers do not correlate with the project identifier, potentially indicating unauthorized cross-tenant deletion attempts (CVE-2026-55065).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55065
author: Valtersit Threat Intelligence
date: 2026/06/01
logsource:
    category: webserver
    product: vikunja
    service: http
detection:
    selection:
        http.method: DELETE
        http.url|contains: '/api/v1/projects/'
        http.url|contains: '/views/'
    filter_known_ok:
        http.url|re: '/api/v1/projects/[0-9]+/views/[0-9]+'
    condition: selection and not filter_known_ok
level: high
falsepositives:
    - Legitimate deletion of own project views by authorized users
    - API clients with unusual URL encoding patterns
tags:
    - attack.t1190
    - cve.2026.55065
    - cwe.285

YARA Rule

rule Vikunja_CVE_2026_55065_Authorization_Bypass
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP requests targeting Vikunja project view deletion API with potential cross-tenant view identifier patterns"
        cve = "CVE-2026-55065"
        date = "2026-06-01"
        severity = "high"
    strings:
        $delete_method = "DELETE" ascii nocase
        $api_path = "/api/v1/projects/" ascii
        $view_path = "/views/" ascii
        $permission_file = "project_view_permissions.go" ascii
        $delete_file = "project_view.go" ascii
        $can_delete = "CanDelete" ascii
        $project_view_id = "project_view_id" ascii
        $task_buckets = "task_buckets" ascii
        $task_positions = "task_positions" ascii
    condition:
        ($delete_method and $api_path and $view_path) or
        ($permission_file and $can_delete) or
        ($delete_file and ($task_buckets or $task_positions or $project_view_id))
}

Suricata IDS Rule

alert http any any -> any any (msg:"Vikunja CVE-2026-55065 - DELETE Project View Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"/api/v1/projects/"; distance:0; content:"/views/"; within:200; http.uri; content:!"/views/"; negated; classtype:attempted-admin; sid:202655065; rev:1; metadata:cve CVE-2026-55065, cwe CWE-285, mitre-tactic T1190;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "DELETE" and 
   url.path rlike "/api/v1/projects/[0-9]+/views/[0-9]+"]
  [network where http.request.method == "DELETE" and 
   url.path rlike "/api/v1/projects/[0-9]+/views/[0-9]+" and 
   url.path != lastSuccessfulPath]

Splunk SPL Query

index=web sourcetype=access_combined method=DELETE
| rex field=uri_path "^/api/v1/projects/(?<project_id>[^/]+)/views/(?<view_id>[^/]+)$"
| table _time, src_ip, user, project_id, view_id, uri_path
| stats count by src_ip, user, project_id
| where count > 5
| eval severity = "high"
| table _time, src_ip, user, project_id, count, severity
| rename src_ip as "Source IP", user as "Authenticated User", project_id as "Project ID", count as "Delete Request Count", severity as "Severity"

Wazuh OSSEC Rule

<rule id="202655" level="12">
    <decoded>
        <program_name>apache|nginx|vikunja</program_name>
    </decoded>
    <match>DELETE /api/v1/projects/</match>
    <match>/views/</match>
    <description>Vikunja CVE-2026-55065 - Potential cross-tenant view deletion attempt detected</description>
    <group>vulnerability, cve-2026-55065, authentication,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-55065</info>
    <info type="cwe">CWE-285</info>
    <options>no_full_log</options>
    <frequency>10</frequency>
    <timeframe>300</timeframe>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source is available. The NVD description states the issue is fixed in version 2.4.0, but no patch commit, advisory, or vendor confirmation is present in tracked patch sources. Do not assume version 2.4.0 is actually released or available until confirmed from vendor sources.

1) Immediate Mitigations:

• Upgrade to Vikunja version 2.4.0 immediately if it has been confirmed released by the vendor. If not yet available, treat all versions as vulnerable.
• Restrict API access: Place the Vikunja API behind a reverse proxy that requires additional authentication headers or IP allowlisting to limit which users can reach the API endpoints directly.
• Monitor DELETE requests: Enable comprehensive web server logging for the Vikunja API and deploy the detection rules above to identify anomalous DELETE /api/v1/projects/*/views/* requests.
• Disable or restrict shared projects: If the Vikunja instance hosts multiple tenants, consider temporarily disabling cross-user project sharing or view sharing to reduce the exposure of view identifiers to unauthorized users.
• Backup frequency increase: Increase the frequency of database backups that capture task_buckets and task_positions tables to minimize data loss in case of exploitation.

2) Patch/Upgrade Steps:

• Monitor the Vikunja GitHub repository releases page for version 2.4.0 (or later) and its release notes confirming the fix.
• When available, upgrade via the official distribution method:
  • Docker: docker pull vikunja/vikunja:2.4.0 (or later) and restart containers.
  • Manual/self-hosted: Download the updated binary or build from source at the tagged release.
• Verify the fix: After upgrading, test the vulnerability by attempting to delete a view from one project while authorizing against another (in a test/staging environment) to confirm the authorization check now validates view-to-project ownership.
• Do not downgrade to versions below 2.4.0 after upgrading.

3) Long-Term Hardening:

• Implement network segmentation to restrict access to the Vikunja API to trusted networks only.
• Enable multi-factor authentication (MFA) for all user accounts to reduce the likelihood of credential compromise leading to authenticated attacks.
• Regularly audit user accounts and revoke access for inactive or unnecessary users.
• Implement database-level backup and restore procedures with regular testing.
• Subscribe to Vikunja security announcements and apply patches within a defined SLA (e.g., 48 hours for critical severities).
• Consider deploying Web Application Firewall (WAF) rules that block or log DELETE requests to the project view API path pattern.
• Review and restrict the sharing model: limit which users can share projects/views across team boundaries.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55065 — Official NIST NVD record with CVSS 8.1 vector and full technical description (as cited above).

2. Vikunja Official Repository: https://github.com/go-vikunja/vikunja — Source repository for the open-source project. Monitor for releases, especially version 2.4.0, and associated security advisory.

3. Vikunja Project Website: https://vikunja.io — Official project site; check changelog and release notes for version 2.4.0 fix confirmation.

4. CWE-285 Reference: https://cwe.mitre.org/data/definitions/285.html — Improper Authorization weakness description, providing context on the vulnerability class.

5. CISA KEV: Not listed — CVE-2026-55065 is not currently in CISA's Known Exploited Vulnerabilities catalog as of the report date. No evidence of exploit-in-the-wild usage has been observed in tracked threat intelligence sources at the time of writing.

Threat Actor Campaigns: None identified at this time. No known threat actor activity, IOCs, or exploit-in-the-wild evidence exists for CVE-2026-55065 in currently tracked intelligence feeds.