CVE-2026-123503
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling default/done bucket references and inconsistent task buckets.