Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-55065 in Vikunja is an Improper Authorization and Authorization Bypass issue. The core problem lies in the DELETE /api/v1/projects/:project/views/:view endpoint, where an authenticated user could provide a view identifier from a different project than the one they were authorized against. The ProjectView.CanDelete function in pkg/models/project_view_permissions.go failed to establish that the view being acted upon actually belonged to the project specified in the path. This allowed the system to proceed with operations on an unauthorized resource.
The provided commit 6895a7765ef1667be4b79df29549d33b9e1ca9ca directly addresses this issue. The patch introduces a new check within both ProjectView.CanDelete and ProjectView.CanUpdate methods. Specifically, the lines if _, err := GetProjectViewByIDAndProject(s, pv.ID, pv.ProjectID); err != nil { return false, err } were added. This code snippet ensures that the ProjectView identified by pv.ID is indeed associated with the ProjectID (pv.ProjectID) before proceeding with further authorization checks or operations. Without this explicit check, the functions were vulnerable to authorization bypass, as they would only verify the user's permissions against the provided project ID, not the ownership of the view itself. The vulnerability description also mentions ProjectView.Delete continuing after a scoped delete affects no rows, but the primary point of failure and the fix implemented in this commit is within the CanDelete (and CanUpdate) authorization checks. By fixing CanDelete, the unauthorized ProjectView.Delete operation is prevented from being initiated in the first place. Therefore, pkg/models.ProjectView.CanDelete and pkg/models.ProjectView.CanUpdate are the precise functions that were vulnerable due to missing authorization logic.
pkg/models.ProjectView.CanDeletepkg/models/project_view_permissions.go
pkg/models.ProjectView.CanUpdatepkg/models/project_view_permissions.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.vikunja.io/api | go | >= 0.24.6, < 2.4.0 | 2.4.0 |