CVE-2026-55064— Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Quick assessment
Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
go-vikunja Vikunja是go-vikunja组织的一款任务管理服务器软件。 go-vikunja Vikunja 2.3.0至2.4.0之前版本存在授权问题漏洞，该漏洞源于对父项目ID验证不当，具有写权限但非管理员的用户可通过将parent_project_id设置为0绕过管理员权限检查，将共享子项目从父层级分离，切断递归权限继承链，可能导致项目所有者的层级结构和继承的协作者访问受到破坏。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| go-vikunja | vikunja | >= 2.3.0, < 2.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55064
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner’s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
go-vikunja Vikunja 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
go-vikunja Vikunja是go-vikunja组织的一款任务管理服务器软件。 go-vikunja Vikunja 2.3.0至2.4.0之前版本存在授权问题漏洞，该漏洞源于对父项目ID验证不当，具有写权限但非管理员的用户可通过将parent_project_id设置为0绕过管理员权限检查，将共享子项目从父层级分离，切断递归权限继承链，可能导致项目所有者的层级结构和继承的协作者访问受到破坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| go-vikunja | vikunja | >= 2.3.0, < 2.4.0 | - |
|
II. Public POCs for CVE-2026-55064
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55064
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55064 (1)
Vendor Advisories for CVE-2026-55064 (1)
Vendor Pages for CVE-2026-55064 (1)
-
🔗 Release v2.4.0 · go-vikunja/vikunja · GitHub x_refsource_MISC
Same Patch Batch · go-vikunja · 2026-08-28 · 5 CVEs total
| CVE-2026-55065 | 8.1 HIGH | Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in co |
| CVE-2026-55066 | 7.1 HIGH | Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id |
| CVE-2026-54766 | 5.3 MEDIUM | Vikunja: Project duplication bypasses write-permission check on the target parent project |
| CVE-2026-55067 | 5.0 MEDIUM | Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-as |
IV. Related Vulnerabilities
Same product: vikunja
-
CVE-2026-115507
Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification E -
CVE-2026-111922
Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting L -
CVE-2026-111920
Vikunja 2.6.0 Broken Access Control via Inherited Project Pe -
CVE-2026-111921
Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link -
CVE-2026-111919
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via W
Same vendor: go-vikunja
-
CVE-2026-115507
Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification E -
CVE-2026-111922
Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting L -
CVE-2026-111920
Vikunja 2.6.0 Broken Access Control via Inherited Project Pe -
CVE-2026-111921
Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link -
CVE-2026-111919
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via W
Same weakness: CWE-862
-
CVE-2026-115972
FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthControl -
CVE-2026-114191
WordPress UPI QR Code Payment Gateway for WooCommerce plugin -
CVE-2026-114192
WordPress WpEvently plugin <= 5.7.8 - Broken Access Control -
CVE-2026-116008
DaybydayCRM through 2.2.1 Missing Authorization via Projects -
CVE-2026-114705
WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken A
V. Comments for CVE-2026-55064
No comments yet