Live › vulnerability › GHSA-pjr3-86v4-5p7w
Go to dashboardVikunja's Go API module (code.vikunja.io/api) silently overrides an explicit lower-permission share on a sub-project with the higher permission inherited from the parent project. A user who was intentionally given restricted access to a sub-project can end up with more access than the owner set.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api
This page as .md · .json · in your agent: get_signal("GHSA-pjr3-86v4-5p7w")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.