TI-2026-76124 Aliases CVE-2026-111918 GHSA-mjqg-gwhm-xr66

Improper authorization in Vikunja task position recalculation

LOW 23CWE-863Published 2026-10-17 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization flaw (CWE-863) in RecalculateTaskPositions. An authenticated user with no accessible projects can write task position rows for all tasks instance-wide. The same weakness lets attackers persist cross-tenant references through saved filters, which can amplify writes into a denial of service. The CVSS 4.0 vector requires low privileges and no user interaction over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00176 7th percentileScored 2026-11-07

Fix Fixed vikunja (go-vikunja): 2.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
go-vikunja	vikunja	1.0.0-rc0 to before 2.7.0	2.7.0	Patch available	CNA

vikunja Vendorgo-vikunja Affected 1.0.0-rc0 to before 2.7.0 Fixed in 2.7.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:vikunja:vikunja::::::::	—	—	go-vikunja

cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions — — ·go-vikunja

Remediation

Upgrade go-vikunja vikunja to version 2.7.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA vikunja (go-vikunja) Fixed in 2.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-17
go-vikunja vikunja 2.7.0
5 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-76128 Permissive CORS policy trusting localhost origins in VikunjaPriority HIGH 67
- TI-2026-76125 Improper access revocation in Vikunja webhooks exposes project dataPriority MEDIUM 64
- TI-2026-76123 Vikunja WebSocket Authentication Ignores Session RevocationPriority MEDIUM 64
Show all 5 records →

Timeline

2026-10-18 Threatist record created from CVE-2026-111918
2026-10-18 Alias added: GHSA-mjqg-gwhm-xr66
2026-10-19 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-fprf-r6rv-xg99)

TI-2026-40929 Authorization bypass in go-vikunja Vikunja CVSS 4.0CRITICAL 9.3
TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
TI-2026-62115 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVSS 4.0HIGH 8.7
TI-2026-62108 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth CVSS 4.0HIGH 8.7
TI-2026-62107 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API CVSS 4.0HIGH 8.7
TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1

See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences