Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55066, describes a Cross-tenant IDOR in Vikunja's kanban move-task endpoint. Specifically, the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint accepted a task_id in the request body without proper authorization. The TaskBucket.CanUpdate function was identified as the point where this authorization was missing. In the vulnerable version, TaskBucket.CanUpdate only checked permissions for the project and view associated with the bucket (from the URL) but did not verify if the authenticated user had permission to modify the specific task identified by the task_id from the request body. This allowed an attacker to enumerate and modify tasks across different tenants by simply changing the task_id in the request body.
The provided patch (commit 36cdc2ce2be0b8ccc74227d178b92047d59cd65f) directly addresses this by adding a new authorization check within TaskBucket.CanUpdate. After verifying the bucket's permissions, the patch introduces a check task := &Task{ID: b.TaskID}; return task.CanWrite(s, a). This new line ensures that the user also has write permissions for the task specified by b.TaskID (the one from the request body). Therefore, the TaskBucket.CanUpdate function is the precise vulnerable function because it lacked this critical authorization logic in the vulnerable version, allowing the IDOR to occur. When the vulnerability is exploited, TaskBucket.CanUpdate would be called, and due to the missing check, it would incorrectly return true for an unauthorized task_id, leading to the IDOR.
kanban_task_bucket.TaskBucket.CanUpdatepkg/models/kanban_task_bucket.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.vikunja.io/api | go | <= 2.3.0 | 2.4.0 |