Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary

The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated (non-link-share) user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an attacker-owned project into another user's or team's project hierarchy.

Details

ProjectDuplicate.CanCreate (pkg/models/project_duplicate.go) is meant to require write access to the parent the duplicate is placed under — its own comment says "Parent project exists + user has write access". The implementation does neither correctly:

func (pd *ProjectDuplicate) CanCreate(s *xorm.Session, a web.Auth) (canCreate bool, err error) {
    pd.Project = &Project{ID: pd.ProjectID}
    canRead, _, err := pd.Project.CanRead(s, a)
    if err != nil || !canRead {
        return canRead, err
    }
    if pd.ParentProjectID == 0 {
        return canRead, err
    }
    // Parent project exists + user has write access to is (-> can create new projects)
    parent := &Project{ID: pd.ParentProjectID}
    return parent.CanCreate(s, a)   // <-- bug
}

Two defects compound here:

1. Wrong permission method. It calls parent.CanCreate ("may I create this project?") instead of parent.CanWrite ("may I create children inside this project?"). The latter is what the normal create path uses — POST /projects with a parent_project_id enforces parent.CanWrite via Project.CanCreate (pkg/models/project_permissions.go:196-199).

2. Unhydrated struct. parent is constructed as &Project{ID: pd.ParentProjectID} and never loaded from the database, so its in-memory ParentProjectID is always 0. Inside Project.CanCreate the only branch that performs any permission check is if p.ParentProjectID != 0 { return parent.CanWrite(...) } — which therefore never executes. Control falls through to the link-share check and then return true, nil. The result is true for any authenticated non-link-share user, for any ParentProjectID.

Nothing downstream re-checks: ProjectDuplicate.Create → CreateProject → checkProjectBeforeUpdateOrDelete (pkg/models/project.go:954) validates only that the parent exists, is not a pseudo-project, and introduces no cycle — no authorization.