Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

[ Description ]Official description

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.

[ Fixes ]Fixes and patches

• code.vikunja.io/api 2.6.0Fixed version · GitHub Advisories · go package code.vikunja.io/api: upgrade to 2.6.0 or later (affected <= 2.5.0)

[ Packages ]Affected open-source packages

• code.vikunja.io/api goAffected <= 2.5.0 · fixed in 2.6.0 · GHSA-w39f-h553-h2mx

[ References ]References

• github.com/go-vikunja/vikunja/security/advisories/GHSA-w39f-h553-h2mxvendor-advisory
• www.vulncheck.com/advisories/vikunja-before-2.6.0-broken-object-level-authorization-via…third-party-advisory