CVE-2026-111921Medium· 5.4▾ SunlitVikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attacker…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.
vikunja >= 0.13.0 < 2.7.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111918Medium· 5.4Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
CVE-2026-91981Medium· 4.3Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints
CVE-2026-91983Medium· 4.3Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters
CVE-2026-91984Medium· 4.3Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project
CVE-2026-111917Medium· 6.5Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
CVE-2026-111919Medium· 6.5Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks