EUVD-2026-103289

Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares...

CVE-2026-111921

Vikunja versions 0.13.0 before 2.7.0 are vulnerable to an incorrect authorization flaw during link share deletion. The root cause is that the delete permission check reads an unloaded share object , allowing project members with Write permission to delete admin-tier link shares . Attackers can ex...