CVE-2026-111918: Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojectid, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated. The described exploitation path uses an account with zero accessible projects after deleting its Inbox and repointing default_project_id.
Are tenants with no projects relevant to exploitation?
Yes. The authorization flaw occurs when RecalculateTaskPositions is invoked for a user with zero accessible projects, allowing that user to write task_positions rows for tasks across the instance.
What is the practical impact of repeated exploitation?
An attacker can create saved filters with empty filters to persist cross-tenant task references and amplify task_positions writes. This can cause denial of service and unauthorized modification of task position data.
How can I identify potentially affected activity?
Review for accounts whose Inbox was deleted after default_project_id was repointed, followed by creation of saved filters with empty filters. Also investigate task_positions writes associated with users that have no accessible projects.
What remediation version is identified by the advisory data?
The issue affects Vikunja versions from 1.0.0-rc0 before 2.7.0. Upgrade to 2.7.0 or later.