CVE-2026-55065 affects Vikunja, an open-source self-hosted task management platform, in versions from 0.24.6 up to but not including 2.4.0. The vulnerability exists in the DELETE /api/v1/projects/:project/views/:view endpoint, which fails to verify that the supplied view identifier belongs to the project being authorized against. The ProjectView.CanDelete function does not enforce ownership between the view and the project path, and ProjectView.Delete continues execution even when no rows are affected by the scoped delete. This allows an authenticated attacker to supply a view ID from another tenant's project while authenticating against their own project, triggering deletion of task_buckets and task_positions records associated with the victim's view. The impact is cross-tenant destruction of Kanban board assignments and task ordering data, while the victim's view and tasks themselves remain intact. The vulnerability is an authorization/access control flaw enabling data integrity attacks across tenant boundaries. The issue has been patched in Vikunja version 2.4.0.