{"id":"CVE-2026-111918","kind":"vulnerability","aliases":["CVE-2026-111918"],"related":[],"title":"Vikunja: authenticated users can write task position rows instance-wide","description":"Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.","summary":"Vikunja, an open-source task manager, has an authorization flaw in its RecalculateTaskPositions routine that lets a logged-in user with no accessible projects write position records for every task on the instance. An attacker can use this to amplify writes and cause denial of service, and to persist cross-tenant references through saved filters.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-user","package","self-hosted","vikunja"],"not_affected_if":["single-user-instance","version-2.7.0-or-later"],"how_to_check":"- Check the installed Vikunja version with `vikunja version` or the version shown in the web UI footer\n- Confirm whether self-registration or untrusted user accounts are enabled on the instance","fix":"- Upgrade Vikunja to `2.7.0` or later\n- unknown whether a workaround exists before upgrading","status":"open","published_at":"2026-10-17T19:16:34+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:16:58+00:00","updated_at":"2026-10-25T04:16:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:16:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.0` or later\n- unknown whether a workaround exists before upgrading","reach":"internet","title":"Vikunja: authenticated users can write task position rows instance-wide","impact":"medium","summary":"Vikunja, an open-source task manager, has an authorization flaw in its RecalculateTaskPositions routine that lets a logged-in user with no accessible projects write position records for every task on the instance. An attacker can use this to amplify writes and cause denial of service, and to persist cross-tenant references through saved filters.","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","multi-user"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user degrades instance-wide task data and causes denial of service","analyst_note":"","how_to_check":"- Check the installed Vikunja version with `vikunja version` or the version shown in the web UI footer\n- Confirm whether self-registration or untrusted user accounts are enabled on the instance","needs_analyst":false,"not_affected_if":["single-user-instance","version-2.7.0-or-later"],"who_is_affected":"Self-hosted or shared Vikunja instances from 1.0.0-rc0 up to but not including 2.7.0 where users other than trusted administrators can log in. Single-user instances with no other accounts have little exposure. The sources do not say whether managed hosting is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3371,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111918':14A,17A '-2026':13A,16A '1.0.0':86C '2.7.0':89C 'access':50B,103C 'allow':98C 'amplifi':67B,140C 'attack':62B,116C 'authent':2A,99C 'author':35B,93C 'caus':70B 'contain':90C 'creat':127C 'cross':78B,136C 'cross-ten':77B,135C 'cve':12A,15A 'default':123C 'delet':118C 'denial':71B,143C 'empti':129C 'empty-filt':128C 'everi':56B 'filter':83B,130C,132C 'flaw':36B 'host':24B 'id':125C 'improp':92C 'inbox':120C 'instanc':10A,60B,114C 'instance-wid':9A,113C 'let':42B 'log':45B 'logged-in':44B 'manag':32B 'multi':19B 'multi-us':18B 'open':29B 'open-sourc':28B 'packag':21B 'persist':76B,134C 'posit':7A,53B,108C 'project':51B,104C,124C 'rc0':87C 'recalculatetaskposit':39B,96C 'record':54B 'refer':80B,138C 'repoint':122C 'routin':40B 'row':8A,109C 'save':82B,131C 'self':23B 'self-host':22B 'servic':73B,145C 'sourc':30B 'task':6A,31B,57B,107C,112C 'tenant':79B,137C 'use':64B 'user':3A,20B,47B,100C 'vikunja':1A,25B,26B,84C 'vulner':94C 'wide':11A,115C 'write':5A,52B,68B,106C,141C 'zero':102C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or shared Vikunja instances from 1.0.0-rc0 up to but not including 2.7.0 where users other than trusted administrators can log in. Single-user instances with no other accounts have little exposure. The sources do not say whether managed hosting is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111918","severity":null,"published_at":"2026-10-17T19:16:34+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}