CVE-2026-111920 go-vikunja CVE debrief

Who should care

Defenders managing Vikunja installations, especially those with project collaboration and permission management, should assess exposure and verify proper project permission management to prevent unauthorized modifications.

Why it matters

Defenders should care about CVE-2026-111920 because it allows collaborators with write access on parent projects to modify child project content, potentially leading to unauthorized project changes and data integrity loss. Verification of project access controls and user permissions is necessary to prevent exploitation.

• Potential unauthorized project modifications by collaborators with write access on parent projects
• Risk of data integrity loss due to improper permission management
• Need for verification of project access controls and user permissions
• Possible impact on project data confidentiality due to access control bypass

Technical summary

The broken access control flaw in Vikunja 2.6.0 allows a collaborator with write access on a parent project but read-only access to a child project to modify the child project's tasks and content. This is due to the system resolving a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. As a result, defenders should prioritize verifying and mitigating this vulnerability in Vikunja 2.6.0 installations, especially in environments where project collaboration and permission management are critical.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in Vikunja 2.6.0 installations, especially in environments where project collaboration and permission management are critical.

Recommended defensive actions

• Verify and update Vikunja installations to ensure proper project permission management
• Review and restrict project access for collaborators to prevent unauthorized modifications
• Monitor project activity for suspicious changes
• Perform a thorough review of project access controls and user permissions
• Inventory affected assets and prioritize remediation based on risk
• Implement compensating controls for exposed systems while remediation is scheduled
• Track exceptions and retest remediated assets to ensure effectiveness

Evidence notes

The CVE record and NVD entry provide details on the broken access control flaw in Vikunja 2.6.0. However, additional information on affected versions, exploitation, and remediation is limited. Defenders should verify Vikunja installations, review project access controls, and monitor for suspicious activity. The CVE Program and NVD entries serve as primary sources, but further investigation may be necessary to fully understand the vulnerability's impact and mitigate potential risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.