CVE-2026-111918 Details
Description
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.
An improper authorization vulnerability has been identified in Vikunja versions 1.0.0-rc0 prior to 2.7.0. This vulnerability allows authenticated users with no accessible projects to manipulate task position data across all tasks in the instance. The issue arises in the 'RecalculateTaskPositions' function, where the lack of project access is not properly handled, enabling users to create cross-tenant references that can disrupt task management and amplify write operations, potentially leading to a denial-of-service condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | >= 1.0.0-rc0, <= 2.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |