CVE-2026-111920Medium· 4.3▾ SunlitVikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.
vikunja 2.6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111917Medium· 6.5Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
CVE-2026-111918Medium· 5.4Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
CVE-2026-111919Medium· 6.5Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
CVE-2026-111922Medium· 6.3Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
CVE-2026-111921Medium· 5.4Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
CVE-2026-91968Medium· 6.5vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits