Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-111921

Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

go-vikunja vikunja

Default version status: unaffected

  • 0.13.0 to < 2.7.0affected
  • 2.7.0unaffected
pkg:golang/code.vikunja.io/api

References