{"id":"CVE-2026-111920","title":"Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions","summary":"Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-269"],"vendor":"go-vikunja","product":"vikunja","affected":["vikunja 2.6.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-18T11:17:24.862920Z"},"exploitAvailable":true,"published":"2026-10-17","updated":"2026-10-18","sourceUpdated":"2026-10-18T11:17:27.926Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111920","references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w","label":"GitHub Security Advisory (GHSA-pjr3-86v4-5p7w)"},{"url":"https://www.vulncheck.com/advisories/vikunja-2.6.0-broken-access-control-via-inherited-project-permissions","label":"VulnCheck Advisory: Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-17T19:08:56.620Z","slug":"CVE-2026-111920","body":"## Overview\n\nVikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.\n\n## Affected\n\n- `vikunja 2.6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":224029,"id":"CVE-2026-111920","ts":1792323683256,"field":"exploit_available","old":"false","new":"true"}]}