A high-severity authorization flaw in the Vikunja platform allows authenticated attackers to perform unauthorized data modifications across projects, leading to significant integrity loss.

The vulnerability is an improper authorization flaw (CWE-285 and CWE-639) occurring within the project view API. An authenticated attacker can manipulate the view identifier to bypass scope checks, resulting in the unauthorized deletion of task buckets and positions within projects they do not own.

Successful exploitation results in the destruction of project data, specifically Kanban board configurations and task ordering. With a CVSS score of 8.1, this vulnerability represents a high risk to operational integrity, potentially disrupting team workflows and causing significant data loss for task management processes.

Immediate Action: Upgrade the Vikunja installation to version 2.4.0 or later to apply the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of DELETE requests directed at the /api/v1/projects/ path, particularly those involving cross-project identifiers.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and validate API parameters, ensuring that project identifiers match the expected tenant context.

Public Exploit Available: No (exploit_available: false)

The vulnerability poses a severe risk to the integrity of task management data within the Vikunja environment. Administrators should prioritize the update to version 2.4.0 immediately to resolve the improper authorization logic and prevent potential cross-tenant disruption.