Incorrect Authorization Vulnerability in Vikunja Product by Vikunja
CVE-2026-111921

5.3MEDIUM

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111921?

The Vikunja product before version 2.7.0 is susceptible to an incorrect authorization vulnerability. This flaw allows project members with write permissions to delete admin-tier link shares due to inadequate permission checks when interacting with share objects. Attackers can exploit this vulnerability by sending DELETE requests to the project share endpoints with share IDs, successfully revoking admin links and disrupting existing share sessions.

Affected Version(s)

vikunja 0.13.0 < 2.7.0

vikunja 2.7.0

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-0.13.0-befor...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.