CVE-2026-68582 go-vikunja CVE debrief

Who should care

Defenders of Vikunja instances, especially those with shared link functionality exposed, should assess exposure and prioritize remediation. This includes reviewing and restricting access to link-share tokens, monitoring for suspicious activity, and implementing additional authorization checks for view access. The vulnerability allows an attacker to read bucket records and enumerate usernames and IDs instance-wide, making it a critical issue for defenders.

Why it matters

CVE-2026-68582 is a critical BOLA vulnerability in Vikunja that allows unauthorized access to kanban buckets and user information across tenants via a link-share token. Defenders should prioritize remediation and verify exposure.

• Unauthorized access to sensitive kanban bucket records
• Enumeration of usernames and IDs across the instance
• Potential for project/view-ID existence oracle attacks
• Need for verification of affected versions and remediation status

Technical summary

The task-collection endpoint in Vikunja fails to verify caller authorization for project views, allowing attackers with a link-share token to access unauthorized kanban views and bucket records across tenants. The vulnerability arises from the failure to validate the view ID against the share's project, enabling an attacker to point the endpoint at any other tenant's kanban view and receive that view's bucket records. This issue is fixed in version 2.4.0 and defenders should prioritize remediation and verify exposure.

Defensive priority

High priority for defenders of Vikunja instances, especially those with shared link functionality exposed.

Recommended defensive actions

• Immediately upgrade to Vikunja version 2.4.0 or later
• Review and restrict access to link-share tokens
• Monitor for suspicious activity on kanban views and bucket records
• Implement additional authorization checks for view access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the lack of pre-authorization view load in the task-collection endpoint, allowing attackers to access unauthorized data. Evidence from the source corpus indicates that this issue is fixed in version 2.4.0. The CVE record was published on 2026-10-09T20:42:33.000Z and has not been modified since then. The vulnerability allows an attacker to read bucket records and enumerate usernames and IDs instance-wide.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.