6 matches found
CVE-2026-111920
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...
CVE-2026-111920
Vikunja version 2.6.0 is vulnerable to a broken access control flaw within the getProjectAccessForUser function (located in pkg/models/project_access.go). The root cause is that the system resolves a user's effective permissions by taking the maximum permission found over the project tree, which ...
CVE-2026-111920 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...
CVE-2026-111920
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...
CVE-2026-111920 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...
EUVD-2026-103288
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...