CyberRota Analysis
AI-GeneratedAuthenticated users of Vikunja versions 0.24.6 to 2.4.0 are vulnerable to a cross-tenant privilege escalation flaw that allows them to delete project views from other projects, potentially leading to unauthorized manipulation of task assignments and ordering. This vulnerability poses a significant risk to organizations using Vikunja for task management, as it can result in data integrity issues across projects. Users of affected versions should prioritize upgrading to version 2.4.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the path project, and ProjectView.Delete in pkg/models/project_view.go continues after the scoped project_views delete affects no rows. Its subsequent deletes select task_buckets and task_positions only by project_view_id, allowing cross-tenant destruction of Kanban assignments and ordering while leaving the victim view and tasks intact. This issue is fixed in version 2.4.0.