Vikunja CVE-2025-5476: Project duplication bypasses parent write-permission check (CWE-285/863)

Summary of Key Vulnerability Information Vulnerability Overview Title: Project duplication bypasses the write-permission check on the target parent project CVE: CVE-2025-5476 Severity: Moderate Weaknesses: CWE-285, CWE-863 Description: The project duplication endpoint does not correctly validate a user's write permission on the target parent project. Any authenticated user (excluding link-share users) can duplicate a project into any parent project, regardless of whether they have write permission for that parent project. This allows an attacker to inject a project owned by the attacker into the project hierarchy of other users or teams. Affected Scope Affected Package: (Go) Affected Versions: >= 0.21.0, <= 2.3.0 Fixed Version: 2.4.0 Impact: - An authenticated user can duplicate any project (including their own) and set it as a child project of any parent project ID, even without write permission for that parent project. - A project owned by the attacker can be injected into another user's "home" project tree; since Vikunja propagates permissions from parent to child projects, the victim may inherit access rights to the injected project. - The core issue is a bypass of the same parent-project write-permission guard, constituting a violation of authorization, integrity, and access control, rather than a confidentiality leak. Root Cause (Code Defect) Two compounding defects: 1. Incorrect permission method: The code calls ("Can I create a project here?") instead of ("Can I modify this project?"). 2. Uninitialized struct: The object is constructed only with and is not loaded from the database. As a result, the in-memory remains 0, causing the branch to return directly, thereby bypassing the actual permission check. Fix In , check write permission on the parent project directly: loads the project from the database and evaluates actual permissions. This resolves both defects of the incorrect method and the uninitialized struct, and also complies with the documented convention (rejecting archived parent projects). Proof of Concept (PoC) 1. As User A, create or obtain read access to any project S (e.g., id=100). 2. Identify a parent project P (e.g., id=5) owned by User B, for which A does not have write access. 3. Call with the body . 4. The request succeeds (HTTP 201); the new project is owned by A and becomes a child of B's project 5, even though A lacks write permission for project 5. 5. The equivalent with is correctly rejected (HTTP 403).

Goal Reached Thanks to every supporter — we hit 100%!

Vikunja CVE-2025-5476: Project duplication bypasses parent write-permission check (CWE-285/863)

More from this source