CVE-2026-111921 Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
Project members with Write permission can delete admin-tier link shares, revoking access and invalidating sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111921?
CVE-2026-111921 is a medium-severity missing authorization vulnerability in go-vikunja vikunja, published on 17 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.
Weakness: CWE-863
Which versions are affected by CVE-2026-111921?
3 open source packages ship an affected version, including code.vikunja.io/api.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | From 0.13.0 | 2.7.0 |
code.vikunja.io/api Go | From 0.13.0 | 2.7.0 |
How do I fix CVE-2026-111921?
Upgrade code.vikunja.io/api to 2.7.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111921 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111921 exists.
Sources
Also known as GHSA-92qc-qm37-9wr9, GHSA-fmmf-xq98-g327, GO-2026-6730.