CVE-2026-111918: Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-17 · updated 2026-10-19
Weakness: CWE-863

Description

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.

Affected products

Go Code.Vikunja.Io/Api: from 1.0.0-rc0 before 2.7.0 — fixed in 2.7.0
go-vikunja vikunja: from 1.0.0-rc0 before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: Go Code.Vikunja.Io/Api 2.7.0; go-vikunja vikunja 2.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-111918 or the next vulnerability affects your stack