Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the path project, and ProjectView.Delete in pkg/models/project_view.go continues after the scoped project_views delete affects no rows. Its subsequent deletes select task_buckets and task_positions only by project_view_id, allowing cross-tenant destruction of Kanban assignments and ordering while leaving the victim view and tasks intact. This issue is fixed in version 2.4.0.

CVE-2026-55065 affects Vikunja, an open-source self-hosted task management platform, in versions from 0.24.6 up to but not including 2.4.0. The vulnerability exists in the DELETE /api/v1/projects/:project/views/:view endpoint, which fails to verify that the supplied view identifier belongs to the project being authorized against. The ProjectView.CanDelete function does not enforce ownership between the view and the project path, and ProjectView.Delete continues execution even when no rows are affected by the scoped delete. This allows an authenticated attacker to supply a view ID from another tenant's project while authenticating against their own project, triggering deletion of task_buckets and task_positions records associated with the victim's view. The impact is cross-tenant destruction of Kanban board assignments and task ordering data, while the victim's view and tasks themselves remain intact. The vulnerability is an authorization/access control flaw enabling data integrity attacks across tenant boundaries. The issue has been patched in Vikunja version 2.4.0.