CyberRota Analysis
AI-GeneratedVikunja, an open-source task management platform, is vulnerable to a mass assignment issue that allows authenticated users to move attacker-owned buckets into other tenants' Kanban views without proper validation. This flaw can lead to cross-tenant defacement, as the relocated buckets retain the attacker's content and ownership. Organizations using versions prior to 2.4.0 should prioritize upgrading to mitigate the risk of unauthorized access and content manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to the URL project and view but does not validate the body selected destination view, allowing any authenticated user to relocate an attacker-owned bucket into another tenant’s Kanban view. The injected bucket retains attacker-controlled content and ownership, enabling cross-tenant defacement. This issue is fixed in version 2.4.0.