CyberRota Analysis
AI-GeneratedThe Vikunja task management platform allows users with Write permissions on a shared child project to detach it from its parent project by submitting a zero value for parent_project_id, bypassing necessary Admin checks. This vulnerability can disrupt project hierarchies and inherited permissions, potentially compromising access control for collaborators. Organizations using Vikunja versions 2.3.0 to 2.4.0 should prioritize upgrading to version 2.4.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner’s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0.