TI-2026-76126 Aliases CVE-2026-111920 GHSA-r72j-vqhw-6264

Vikunja lets collaborators modify child projects they only read

MEDIUM 57CWE-269Published 2026-10-17 · Updated 2026-10-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser, which resolves a user's effective project permission as the maximum over the project tree. The maximum silently overrides explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify that child project's tasks and content.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00191 8th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
go-vikunja	vikunja	2.6.0	—	No fix listed	CNA

vikunja Vendorgo-vikunja Affected 2.6.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:vikunja:vikunja::::::::	—	—	go-vikunja

cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* Versions — — ·go-vikunja

Remediation

The sources list no fixed version for Vikunja.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-18 Threatist record created from CVE-2026-111920
2026-10-18 Alias added: GHSA-r72j-vqhw-6264

References

Advisory 1

GitHub Security Advisory (GHSA-pjr3-86v4-5p7w)

TI-2026-40929 Authorization bypass in go-vikunja Vikunja CVSS 4.0CRITICAL 9.3
TI-2026-21967 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVSS 3.1CRITICAL 9.1
TI-2026-62115 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVSS 4.0HIGH 8.7
TI-2026-62108 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth CVSS 4.0HIGH 8.7
TI-2026-62107 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API CVSS 4.0HIGH 8.7
TI-2026-26971 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path CVSS 3.1CRITICAL 9.1

See all 105 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences