CVE-2026-111921

Vikunja versions 0.13.0 before 2.7.0 are vulnerable to an incorrect authorization flaw during link share deletion. The root cause is that the delete permission check reads an unloaded share object , allowing project members with Write permission to delete admin-tier link shares . Attackers can ex...