Live › vulnerability › GHSA-fmmf-xq98-g327
Go to dashboardVikunja's Go API module (code.vikunja.io/api) has an authorization flaw where a user with write-level access to a project can delete link shares that require admin-level permission. The sources describe this as an unloaded permission check, which lets the attacker remove sharing links they should not be able to touch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: .
This page as .md · .json · in your agent: get_signal("GHSA-fmmf-xq98-g327")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.