CVE-2026-111920

Vikunja version 2.6.0 is vulnerable to a broken access control flaw within the getProjectAccessForUser function (located in pkg/models/project_access.go). The root cause is that the system resolves a user's effective permissions by taking the maximum permission found over the project tree, which ...