Live › vulnerability › CVE-2026-111920
Go to dashboardVikunja 2.6.0 resolves a user's project permission as the maximum across the project tree, so an explicit read-only share on a sub-project is overridden. A collaborator with write access to the parent project can modify tasks and content in the read-only child project.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Vikunja 2.6.0 that share parent projects with collaborators and use read-only shares on sub-projects. Installations that do not use nested projects with mixed sharing levels are unlikely to be exposed. Instances on other versions are not covered by the sources.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.
This page as .md · .json · in your agent: get_signal("CVE-2026-111920")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.