Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.vikunja.io/api | go | <= 2.3.0 | 2.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55067, is a mass assignment issue in the Vikunja backend API. The analysis of the provided patch commit b31d606b8879ebe98fbb2ac5d8b3066b86f59868 clearly indicates that the root cause was in the Bucket.Update function located in pkg/models/kanban.go. The patch explicitly removes the project_view_id field from the list of columns that can be modified through this function. Before the patch, an attacker could send a POST request to the bucket update endpoint and include a project_view_id pointing to another user's Kanban view. Because the application did not validate that the destination view belonged to the same project or user, it would relocate the attacker's bucket, leading to a cross-tenant data injection and defacement. The vulnerable function is therefore Bucket.Update, as it directly processed the malicious input.
Bucket.Updatepkg/models/kanban.go