Live › vulnerability › CVE-2026-111918
Go to dashboardVikunja, an open-source task manager, has an authorization flaw in its RecalculateTaskPositions routine that lets a logged-in user with no accessible projects write position records for every task on the instance. An attacker can use this to amplify writes and cause denial of service, and to persist cross-tenant references through saved filters.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or shared Vikunja instances from 1.0.0-rc0 up to but not including 2.7.0 where users other than trusted administrators can log in. Single-user instances with no other accounts have little exposure. The sources do not say whether managed hosting is affected.
No product ranges from the sources yet.
vikunja version or the version shown in the web UI footer2.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-111918")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.