{"id":"GHSA-w2ch-4xgr-22ww","kind":"vulnerability","aliases":["GHSA-w2ch-4xgr-22ww","GO-2026-6754"],"related":[],"title":"Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api","description":"Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api from v0.9.0 before v2.6.0.","summary":"Vikunja's Go API module (code.vikunja.io/api) does not check read access to the other task when deleting a task relation, so a user can remove relations between tasks in projects they cannot read. The sources do not state the exact privilege or data exposure beyond removing relations across projects.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["version-at-or-above-v2.6.0"],"how_to_check":"Check whether your go.mod pins code.vikunja.io/api below v2.6.0 (run: go list -m code.vikunja.io/api).","fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.","status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:24+00:00","updated_at":"2026-10-23T20:15:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:15:24Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.6.0 or later.\nunknown","summary":"Vikunja's Go API module (code.vikunja.io/api) does not check read access to the other task when deleting a task relation, so a user can remove relations between tasks in projects they cannot read. The sources do not state the exact privilege or data exposure beyond removing relations across projects.","category":"package","who_cares":["go","vikunja","self-hosted"],"confidence":0.7,"analyst_note":"Confirm the fixed version and attacker preconditions (any authenticated user vs. shared project membership) at https://pkg.go.dev/vuln/GO-2026-6754 and the GHSA-w2ch-4xgr-22ww advisory.","how_to_check":"Check whether your go.mod pins code.vikunja.io/api below v2.6.0 (run: go list -m code.vikunja.io/api).\nunknown","needs_analyst":true,"not_affected_if":["version-at-or-above-v2.6.0"],"severity_if_unknown":"medium"},"cost_usd":0.000396,"input_tokens":2120,"output_tokens":367,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':30A '-6754':31A '/api':23A,39A,168C '/api)':53B '/api.':119C '22ww':28A,36A '4xgr':27A,35A 'access':9A,58B,105C 'across':95B 'addit':128C,160C 'advisori':123C 'affect':161C 'allow':14A,110C 'api':49B 'automat':134C 'beyond':92B 'cannot':79B 'caus':144C 'check':7A,56B,103C 'code.vikunja.io':22A,38A,52B,118C,167C 'code.vikunja.io/api':21A,37A,166C 'code.vikunja.io/api)':51B 'code.vikunja.io/api.':117C 'contain':127C 'could':131C 'cross':16A,112C 'cross-project':15A,111C 'data':90B 'delet':4A,64B,100C 'edit':155C 'exact':87B 'exposur':91B 'fals':146C 'false-posit':145C 'ghsa':25A,33A 'ghsa-w2ch-4xgr-22ww':24A,32A 'go':29A,40B,48B,138C 'host':44B 'map':135C 'modul':50B,139C,162C 'note':120C 'packag':41B 'pleas':152C 'posit':147C 'privileg':88B 'project':17A,77B,96B,113C 'read':8A,57B,80B,104C 'relat':3A,18A,67B,73B,94B,99C,114C 'remov':19A,72B,93B,115C 'report':126C,148C,158C 'scanner':151C 'self':43B 'self-host':42B 'sourc':82B,122C 'standard':137C 'state':85B 'suggest':153C 'task':2A,13A,62B,66B,75B,98C,109C 'user':70B 'v0.9.0':170C 'v2.6.0':172C 'version':129C,140C,164C 'vikunja':1A,45B,46B,97C 'vulner':150C 'w2ch':26A,34A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6754","url":"https://pkg.go.dev/vuln/GO-2026-6754","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}