{"id":"GHSA-fprf-r6rv-xg99","kind":"vulnerability","aliases":["GHSA-fprf-r6rv-xg99","GO-2026-6731"],"related":[],"title":"Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api","description":"Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .","summary":"Creating a Vikunja saved filter with an empty filter string makes the code recalculate task positions across all tenants in the code.vikunja.io/api Go module. The sources do not describe the data exposure or integrity impact beyond cross-tenant task position recalculation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","multi-tenant","package","self-hosted","vikunja"],"not_affected_if":["not-using-saved-filters","single-tenant-deployment"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:25+00:00","updated_at":"2026-10-23T20:15:25+00:00","category":"package","confidence":0.45,"triage":{"at":"2026-10-23T20:15:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Creating a Vikunja saved filter with an empty filter string makes the code recalculate task positions across all tenants in the code.vikunja.io/api Go module. The sources do not describe the data exposure or integrity impact beyond cross-tenant task position recalculation.","category":"package","who_cares":["go","vikunja","self-hosted","multi-tenant"],"confidence":0.45,"analyst_note":"Check https://pkg.go.dev/vuln/GO-2026-6731 for the fixed version range and whether the cross-tenant effect allows reading or modifying other tenants' data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-tenant-deployment","not-using-saved-filters"],"severity_if_unknown":"medium"},"cost_usd":0.000347,"input_tokens":2089,"output_tokens":277,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':26A '-6731':27A '/api':19A,35A,68B '/api.':107C 'across':13A,61B,101C 'addit':116C,148C 'advisori':111C 'affect':149C 'automat':122C 'beyond':82B 'caus':132C 'code':57B 'code.vikunja.io':18A,34A,67B,106C 'code.vikunja.io/api':17A,33A,66B 'code.vikunja.io/api.':105C 'contain':115C 'could':119C 'creat':45B 'creation':4A,92C 'cross':84B 'cross-ten':83B 'data':77B 'describ':75B 'edit':143C 'empti':7A,52B,95C 'exposur':78B 'fals':134C 'false-posit':133C 'filter':3A,8A,49B,53B,91C,96C 'fprf':22A,30A 'ghsa':21A,29A 'ghsa-fprf-r6rv-xg99':20A,28A 'go':25A,36B,69B,126C 'host':43B 'impact':81B 'integr':80B 'make':55B 'map':123C 'modul':70B,127C,150C 'multi':38B 'multi-ten':37B 'note':108C 'packag':40B 'pleas':140C 'posit':12A,60B,87B,100C,135C 'r6rv':23A,31A 'recalcul':10A,58B,88B,98C 'report':114C,136C,146C 'save':2A,48B,90C 'scanner':139C 'self':42B 'self-host':41B 'sourc':72B,110C 'standard':125C 'string':9A,54B,97C 'suggest':141C 'task':11A,59B,86B,99C 'tenant':15A,39B,63B,85B,103C 'version':117C,128C,152C 'vikunja':1A,44B,47B,89C 'vulner':138C 'xg99':24A,32A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6731","url":"https://pkg.go.dev/vuln/GO-2026-6731","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}