CVE-2026-68582
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
The task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the *view* is taken from the attacker-controlled path and never re-validated against the share.
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v4.0)
- EPSS
- 0.27% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- code.vikunja.io/api (go) >= 0.24.0, <= 2.3.0, fixed in 2.4.0 · GHSA-rj9j-8772-4h6c