{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vikunja-all-versions-prior-to-patch/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vikunja (all versions prior to patch)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","web-application","data-destruction"],"_cs_type":"advisory","_cs_vendors":["Vikunja"],"content_html":"\u003cp\u003eVikunja contains an authorization bypass vulnerability (CWE-639) within the \u003ccode\u003eProjectView.Delete\u003c/code\u003e method, which fails to properly validate that a requested view ID belongs to the project ID specified in the API path. Although the initial permission check correctly verifies that the user is an administrator of the provided project, the subsequent cascading delete operations on the \u003ccode\u003etask_buckets\u003c/code\u003e and \u003ccode\u003etask_positions\u003c/code\u003e tables are performed using only the view ID. Because the application does not verify the relationship between the project and the view during these cascading operations, an authenticated attacker can supply their own project ID while targeting a view ID belonging to a victim project. This results in the silent destruction of all Kanban bucket assignments and task orderings for the victim view, with no programmatic recovery path other than restoring from backups. The issue originates in \u003ccode\u003epkg/models/project_view.go\u003c/code\u003e and affects all versions prior to the patch.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker registers a local account on the target Vikunja instance (no special privileges required).\u003c/li\u003e\n\u003cli\u003eAttacker creates a new project via \u003ccode\u003ePUT /api/v1/projects\u003c/code\u003e, granting themselves Admin access to the new project ID (\u003ccode\u003eP_A\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker identifies a victim Kanban view ID (\u003ccode\u003eV\u003c/code\u003e) by enumerating projects or observing API traffic.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious \u003ccode\u003eDELETE\u003c/code\u003e request: \u003ccode\u003eDELETE /api/v1/projects/P_A/views/V\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application's \u003ccode\u003eCanDelete\u003c/code\u003e method validates the user is an admin of \u003ccode\u003eP_A\u003c/code\u003e and permits the request.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eProjectView.Delete\u003c/code\u003e method executes the first scoped SQL statement, which fails silently because \u003ccode\u003eV\u003c/code\u003e does not belong to \u003ccode\u003eP_A\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe function proceeds to execute subsequent unscoped SQL \u003ccode\u003eDELETE\u003c/code\u003e statements on the \u003ccode\u003etask_buckets\u003c/code\u003e and \u003ccode\u003etask_positions\u003c/code\u003e tables using \u003ccode\u003eV\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAll Kanban organization data for the victim view \u003ccode\u003eV\u003c/code\u003e is permanently deleted from the database.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the permanent loss of all task-to-bucket mappings and custom task ordering for the targeted Kanban view. This causes significant operational disruption for teams relying on Kanban boards, requiring manual reconfiguration or restoration from database backups. The vulnerability is highly accessible as it requires only standard user registration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Vikunja immediately to the version containing the security patch that enforces project-view relationship validation within the \u003ccode\u003eProjectView.Delete\u003c/code\u003e model method.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation to verify that \u003ccode\u003eview_id\u003c/code\u003e maps to the \u003ccode\u003eproject_id\u003c/code\u003e provided in the API request before any database modification occurs.\u003c/li\u003e\n\u003cli\u003eEnsure database backups are performed regularly and tested for restoration to mitigate the impact of data destruction vulnerabilities.\u003c/li\u003e\n\u003cli\u003eReview audit logs for \u003ccode\u003eDELETE\u003c/code\u003e operations on the \u003ccode\u003eproject_views\u003c/code\u003e endpoint that target views not associated with the authenticated user's project ownership.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-28T21:18:53Z","date_published":"2026-08-28T21:18:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-vikunja-auth-bypass/","summary":"An improper authorization vulnerability in Vikunja allows authenticated users to destroy task organization data in other projects by supplying a target view ID within a crafted API request.","title":"Vikunja Improper Authorization via ProjectView Deletion","url":"https://feed.craftedsignal.io/briefs/2026-08-vikunja-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Vikunja (All Versions Prior to Patch)","version":"https://jsonfeed.org/version/1.1"}