GO-2026-6731 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-116487

Name of the Vulnerable Software and Affected Versions Vikunja versions 1.0.0-rc0 through 2.6.9 Description An improper authorization issue exists in the RecalculateTaskPositions function. This allows authenticated users who have no accessible projects to write task positions rows for all tasks...

GHSA-GG93-X632-9CCV Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Summary A user with only a single self-owned project can permanently destroy the Kanban bucket assignments taskbuckets and task ordering taskpositions of any other project view in the entire instance. The ProjectView.Delete model method runs three SQL statements: the first is properly scoped to...