CVE-2026-111920: Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/projectaccess.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.
Affected Software
Event History
Frequently Asked Questions
Which permission arrangement is vulnerable?
The issue applies when a collaborator has write access on a parent project and an explicit read-only share on one of its child projects. The inherited parent permission is treated as the effective maximum permission, overriding the lower child-project share.
What does an attacker need to exploit this?
An attacker needs an existing collaborator account with write permission on a parent project and network access to the Vikunja instance. No user interaction is required.
What unauthorized actions are possible?
The collaborator can modify tasks and other content in the child project despite being explicitly limited to read-only access there.
How can administrators identify potentially affected access assignments?
Review project trees for users or collaborators who have write access on a parent project while holding an explicit lower-permission, such as read-only, share on a descendant project. Those lower-permission restrictions may not be enforced as intended.