---
id: "CVE-2026-111918"
kind: "vulnerability"
aliases: ["CVE-2026-111918"]
title: "Vikunja: authenticated users can write task position rows instance-wide"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multi-user", "package", "self-hosted", "vikunja"]
not_affected_if: ["single-user-instance", "version-2.7.0-or-later"]
published_at: "2026-10-17T19:16:34+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:16:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111918", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Vikunja: authenticated users can write task position rows instance-wide

Vikunja, an open-source task manager, has an authorization flaw in its RecalculateTaskPositions routine that lets a logged-in user with no accessible projects write position records for every task on the instance. An attacker can use this to amplify writes and cause denial of service, and to persist cross-tenant references through saved filters.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vikunja version with `vikunja version` or the version shown in the web UI footer
- Confirm whether self-registration or untrusted user accounts are enabled on the instance

## Fix

- Upgrade Vikunja to `2.7.0` or later
- unknown whether a workaround exists before upgrading

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111918

## From the sources

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_