13 matches found
CVE-2026-111918
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...
CVE-2026-111918
The Vikunja task management application (versions 1.0.0-rc0 before 2.7.0 ) is vulnerable to an improper authorization vulnerability in the RecalculateTaskPositions function. This flaw allows authenticated users with no accessible projects to write task_positions rows for all tasks across the enti...
CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...
CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...
CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...
EUVD-2026-103303
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...
CVE-2026-111918
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...
CVE-2026-111918: Incorrect Authorization
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...
go-vikunja Vikunja Authorization Issue Vulnerability
The go-vikunja Vikunja versions from 1.0.0-rc0 to 2.7.0 had an authorization issue. This vulnerability stemmed from improper authorization in the RecalculateTaskPositions function, allowing authenticated users with access to the project to write to the taskpositions row for all tasks. An attacker...
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...
GHSA-FPRF-R6RV-XG99 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...
PT-2026-117121
Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...
PT-2026-116487
Name of the Vulnerable Software and Affected Versions Vikunja versions 1.0.0-rc0 through 2.6.9 Description An improper authorization issue exists in the RecalculateTaskPositions function. This allows authenticated users who have no accessible projects to write task positions rows for all tasks...