Live › vulnerability › CVE-2026-111921
Go to dashboardVikunja versions from 0.13.0 before 2.7.0 let a project member with Write permission delete admin-level link shares, because the delete permission check reads an unloaded share object. An attacker can send DELETE requests to the projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Vikunja instances on versions from 0.13.0 up to 2.7.0 where some users hold Write permission on projects that have admin-tier link shares. Instances where every user is an admin or only read access is granted to project members are less exposed. The sources do not say whether the flaw is reachable without an account, but the attacker must already be a project member with Write permission.
No product ranges from the sources yet.
vikunja version or the server build info; affected if it is 0.13.0 up to but not including 2.7.02.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-111921")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.