CVE-2026-68582 go-vikunja CVE debrief

Who should care

Administrators and users of Vikunja versions between 0.24.0 and 2.3.0 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and restricting access to the task-collection endpoint, monitoring for suspicious activity, and upgrading to version 2.4.0 or later. Organizations using Vikunja should prioritize upgrading to the fixed version to address the BOLA vulnerability. Additionally, users with link-share tokens should be cautious, as they may be able to access kanban bucket records across tenants. Security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. Asset inventory and vulnerability management teams should also be informed to ensure proper tracking and mitigation of this vulnerability. The existence of this vulnerability also highlights the importance of source tracking and verifying the authenticity of requests to the task-collection endpoint. By taking these steps, organizations can minimize the risk associated with this BOLA vulnerability in Vikunja. Security teams should also consider the project/view-ID existence oracle aspect of this vulnerability and implement measures to prevent its exploitation. Overall, a comprehensive approach to addressing this vulnerability involves a combination of technical measures, user awareness, and security best practices. By prioritizing the mitigation of this vulnerability, organizations can protect their systems and data from potential exploitation. The BOLA vulnerability in Vikunja's task-collection endpoint has significant implications for the security of affected systems, and prompt action is necessary to prevent exploitation. Therefore, it is essential that administrators and

Technical summary

The task-collection endpoint in Vikunja versions >= 0.24.0 and <= 2.3.0 is vulnerable to Broken Object Level Authorization (BOLA). The endpoint does not verify caller authorization for requested project views, allowing link-share token holders to access kanban bucket records across tenants. This includes bucket titles and created_by user objects, but task contents are limited to the share's project. The vulnerability also provides a project/view-ID existence oracle.

Defensive priority

Organizations using Vikunja versions between 0.24.0 and 2.3.0 should prioritize upgrading to version 2.4.0 to address the BOLA vulnerability.

Recommended defensive actions

• Upgrade to Vikunja version 2.4.0 or later
• Review and restrict access to task-collection endpoint
• Monitor for suspicious activity on the endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates a BOLA vulnerability in Vikunja's task-collection endpoint. The endpoint fails to verify caller authorization for requested project views, allowing link-share token holders to read kanban bucket records across tenants. Task contents remain limited to the share's project. The issue is fixed in version 2.4.0.

Official resources