{"id":"GHSA-pjr3-86v4-5p7w","kind":"vulnerability","aliases":["GHSA-pjr3-86v4-5p7w","GO-2026-6745"],"related":[],"title":"Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api","description":"Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api","summary":"Vikunja's Go API module (code.vikunja.io/api) silently overrides an explicit lower-permission share on a sub-project with the higher permission inherited from the parent project. A user who was intentionally given restricted access to a sub-project can end up with more access than the owner set.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["no-project-sharing-in-use"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:24+00:00","updated_at":"2026-10-23T20:15:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T20:15:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Vikunja's Go API module (code.vikunja.io/api) silently overrides an explicit lower-permission share on a sub-project with the higher permission inherited from the parent project. A user who was intentionally given restricted access to a sub-project can end up with more access than the owner set.","category":"package","who_cares":["vikunja","self-hosted","go"],"confidence":0.5,"analyst_note":"Sources give no fixed version or severity; check https://pkg.go.dev/vuln/GO-2026-6745 and GHSA-pjr3-86v4-5p7w for the patched release and whether the regression is limited to v2.6.0.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-project-sharing-in-use"],"severity_if_unknown":"unknown"},"cost_usd":0.000348,"input_tokens":2054,"output_tokens":285,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':39A '-6745':40A '/api':32A,48A,139C '/api)':62B '5p7w':37A,45A '86v4':36A,44A 'access':21A,92B,103B,128C 'api':58B 'broken':20A,127C 'code.vikunja.io':31A,47A,61B,138C 'code.vikunja.io/api':30A,46A,137C 'code.vikunja.io/api)':60B 'control':22A,129C 'end':99B 'explicit':2A,66B,109C 'ghsa':34A,42A 'ghsa-pjr3-86v4-5p7w':33A,41A 'given':90B 'go':38A,49B,57B 'higher':78B 'host':53B 'inherit':17A,80B,124C 'intent':89B 'lower':4A,68B,111C 'lower-permiss':3A,67B,110C 'manag':25A,132C 'modul':59B 'overrid':64B 'overridden':14A,121C 'owner':106B 'packag':50B 'parent':18A,83B,125C 'permiss':5A,19A,69B,79B,112C,126C 'pjr3':35A,43A 'privileg':24A,131C 'privilege-manag':23A,130C 'project':11A,75B,84B,97B,118C 'regress':26A,133C 'restrict':91B 'self':52B 'self-host':51B 'set':107B 'share':6A,70B,113C 'silent':13A,63B,120C 'sub':10A,74B,96B,117C 'sub-project':9A,73B,95B,116C 'user':86B 'v2.6.0':28A,135C 'vikunja':1A,54B,55B,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6745","url":"https://pkg.go.dev/vuln/GO-2026-6745","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}