External risk intelligence

Vikunja Task-Collection Endpoint Broken Object Level Authorization

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-68582

Vikunja is a project management web application. It is commonly deployed as an internet-facing web service or API to facilitate remote collaboration, making its endpoints, including those related to project views and task collections, commonly reachable from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Vikunja's task-collection endpoint that allows unauthorized access to project view data, specifically bucket titles and user information, when using link-share tokens. This could potentially expose details about who created tasks within different projects, even for users who should not have access. The issue stems from a failure to properly validate authorization for requested project views.

Unauthorized access to task-related information.
Affects sharing features, potentially exposing user and task details.
Confirm relevance and exposure of Vikunja instances with shared links.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by crafting a special link. This link, when accessed, can reveal details about other users' projects and tasks, even if the attacker doesn't have direct access to those projects. The vulnerability stems from how the application handles project view requests, specifically by not properly checking authorization before loading the requested data.

Entry condition: Share link token.
Trigger point: Accessing crafted endpoint.
Resulting risk: Disclosure of tenant data.

Live Threat

Current exploitation, exposure, and threat context

A broken object-level authorization vulnerability in the task-collection endpoint could allow unauthorized access to sensitive information when a link-share token holder crafts a specific request. Specifically, a holder of any project share link could potentially view bucket titles and the full "created\_by" user object for other tenants' data across all views within the instance. The vulnerability also creates an oracle that could reveal the existence of projects and views. Task contents themselves are not exposed.

Tenant-specific bucket titles and user details.
Via crafted link-share token requests.
Unauthorized data exposure and discovery.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Vikunja affects application owners and platform teams responsible for its deployment and maintenance. The initial step is to identify all instances of the affected technology, determine their reachability and criticality, and confirm the accountable owner for each. Subsequently, a remediation plan should be developed based on the assessed risk.

Identify affected Vikunja deployments.
Verify reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Vikunja?

Vikunja is a project management web application designed to help teams organize tasks and collaborate. Users frequently host it as an internet-facing web service to allow remote access for planning, tracking progress, and managing project workflows across different team environments.

What does broken object level authorization mean for CVE-2026-68582?

This vulnerability, classified as CWE-639, occurs when an application fails to check if a user is permitted to access a specific data object. In this case, Vikunja does not verify if a requester is authorized to view a specific project layout, allowing them to access data from projects they should not be able to see.

How can an attacker trigger this vulnerability?

An attacker can exploit this by using a project share link to access a crafted API request. By manipulating the project and view identifiers in the URL, they can force the application to load unauthorized data. Notably, the actual contents of the tasks remain protected; the flaw only exposes metadata like bucket titles and user profile information.

Do I need to worry if my Vikunja instance is not on the internet?

Halo Surface Signal indicates that Vikunja is commonly deployed as an internet-facing service, which increases the likelihood of external access. If your instance is restricted to an internal network, the risk is lower but still present for any authenticated user or person with access to a valid project share link who could interact with these API endpoints.

What should I do if I am running an affected version of Vikunja?

You should prioritize identifying all active deployments within your infrastructure. Once located, verify their current version against the affected range and prepare to update to version 2.4.0 or later, which contains the fix for this authorization flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.