CVE-2026-111920 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
A collaborator with write access to a parent project can improperly modify tasks in child projects due to flawed permission inheritance logic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111920?
CVE-2026-111920 is a medium-severity missing authorization vulnerability in go-vikunja vikunja, published on 17 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.
Weakness: CWE-269
Which versions are affected by CVE-2026-111920?
3 open source packages ship an affected version, including code.vikunja.io/api.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | From 2.6.0 | 2.7.0 |
code.vikunja.io/api Go | From 2.6.0 | 2.7.0 |
How do I fix CVE-2026-111920?
Upgrade code.vikunja.io/api to 2.7.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111920 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111920 exists.
Sources
Also known as GHSA-pjr3-86v4-5p7w, GHSA-r72j-vqhw-6264, GO-2026-6745.