ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-111921

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Published Oct 9, 2026 · catalog updated Oct 18, 2026 · Vikunja: Write-level project members

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-111921. A missing EPSS score is not a low risk. Compare Vikunja: Write-level project members with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Vikunja: Write-level project members).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Not in the current FIRST EPSS dataset
Remediation
Advisory link
Affected products
Go code.vikunja.io/api

## Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project Write permission instead of requiring Admin. ## Details Affected endpoints: - - Older v1 releases used before lists were renamed to projects. In , the delete handler passes to . The v1 generic handler likewise binds the URL IDs without loading the stored share. calls before . delegates to in . That helper loads the project but does not load the link share, then evaluates: On deletion, is its Go zero value, (0), even when the stored share grants (2). A Write member therefore passes authorization. subsequently deletes by share ID and project ID without checking the stored permission. Create uses the requested permission and correctly rejects Write members creating admin shares. Share listing and by-ID reads are admin-gated in current main. There is no HTTP update route for link shares. Read-only members and link-share principals are rejected on deletion. ## Affected versions and verification The admin-tier check was introduced in commit , first included in v0.13, without loading the stored share on deletion. The affected range established by this review is ; versions before v0.13 have not been assessed here. The v2 route was added in , first included in v2.4.0. The reporter states that both API versions were verified live against a local source build at on September 7, 2026. Maintainer-side source review confirmed the mechanism in that commit, release v2.6.0, and upstream main at . The live proof of concept was not independently rerun during this triage. No patched version is available at draft creation. ## Impact A Write collaborator can revoke an admin-tier access link on a project they can already write to. New consumers can no longer authenticate with that link. In versio

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go code.vikunja.io/api0.13.0 → 2.6.0

How to fix CVE-2026-111921

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-111921. A missing EPSS score is not a low risk. Compare Vikunja: Write-level project members with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0.13.0 → 2.6.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 17, 2026 · NIST NVD

    Detected

    Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.

  2. Oct 18, 2026 · GitHub Advisory Database

    Fix available

    code.vikunja.io/api fixed in 2.6.0

  3. Oct 18, 2026 · GitHub Advisory Database

    Updated

    ## Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project Write permission instead of requiring Admin. ## Details Affected endpoints: - - Older v1 releases used

Sources

  • CVE.orgVulnerability recordCVE-2026-111921

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-fmmf-xq98-g327

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • Go Vulnerability DatabasePackage advisoryGHSA-fmmf-xq98-g327

    Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

    osv.dev
  • NIST NVDVulnerability recordCVE-2026-111921

    Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-fmmf-xq98-g327

    Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.