Medium severity5.4NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026
CVE-2026-123503
CVE-2026-123503
Description
Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling default/done bucket references and inconsistent task buckets.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.7.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.