CVE-2026-111921: Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A Vikunja project member with Write permission can exploit it. The attacker needs to be able to send DELETE requests to the v1 or v2 project share endpoints and target share IDs.
What is the practical impact of exploitation?
An attacker can delete admin-tier link shares, revoke those links, and invalidate existing sessions that use them. The issue affects authorization for link-share deletion rather than confidentiality directly.
Which deployments are affected?
Vikunja versions from 0.13.0 up to, but not including, 2.7.0 are affected. The vulnerable behavior applies where project members have Write permission and link shares are in use.
How can I investigate whether this has been exploited?
Review requests to the v1 and v2 project share DELETE endpoints, especially from Write-level project members. Look for deletion of admin-tier link shares and resulting invalidation of link-share sessions.