Auth bypass in Go-Vikunja Vikunja
CVE-2026-123518
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- GitHub Security Advisory (GHSA-w64q-7p4m-j8g8) (vendor-advisory)
- VulnCheck Advisory: Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move (third-party-advisory)
Frequently asked questions
- What is CVE-2026-123518?
- CVE-2026-123518 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-11-08.
- How severe is CVE-2026-123518?
- Medium severity. CVSS v3 base score is 4.3 out of 10.