Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the view is taken from the attacker-controlled path and never re-validated. As a result, a holder of any project share link can read any other tenant's kanban bucket records — bucket titles and the full created_by user object (username, name, id) — for every view in the instance. The same missing pre-authorization view load also creates a project/view-ID existence oracle (404 vs. non-404) usable by link shares and ordinary authenticated users. Task contents remain constrained to the share's own project and are not disclosed. Fixed in 2.4.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-68582 (CVSS 9.3) affects Vikunja 0.24.0-2.3.0 with BOLA in the task-collection endpoint. Review usage and apply updates if needed: https://nvd.nist.gov/vuln/detail/CVE-2026-68582 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/GswkA0csrq
Post summary
The tweet highlights a high‑severity BOLA vulnerability in Vikunja and recommends applying updates to mitigate the risk.
CVE-2026-68582 Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{projec… https://www.cve.org/CVERecord?id=CVE-2026-68582
Post summary
The text details CVE‑2026‑68582, a broken object level authorization flaw in Vikunja’s task‑collection endpoint affecting a range of versions, without providing evidence of exploitation, patches, or a PoC.
CVE-2026-68582 Broken Object Level Authorization in Vikunja Task-Collection Endpoint Versions 0.24.0-2.3.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-68582
Post summary
The text reports a Broken Object Level Authorization flaw in Vikunja Task-Collection Endpoints, affecting versions 0.24.0-2.3.0, with no additional details on exploitation or mitigation.