Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.

CVE-2026-55066 affects Vikunja, an open-source self-hosted task management platform, in versions prior to 2.4.0. The vulnerability exists in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint, which accepts a user-supplied task_id in the request body. The authorization logic in TaskBucket.CanUpdate only validates the project, view, and bucket from the URL, failing to verify whether the authenticated user has permission to access the task specified in the body. This allows an authenticated attacker to enumerate cross-tenant tasks by exploiting the fact that task identifiers are globally sequential integers. Additionally, the attacker can modify the completion state of victim tasks by specifying a 'done' bucket. The flaw is present in both the v1 and v2 API routes that share the same underlying model. The vulnerability has been patched in Vikunja version 2.4.0, with a fix committed to the official GitHub repository.