CVE-2026-111921 go-vikunja CVE debrief

Who should care

Defenders responsible for Vikunja deployments, particularly those with project members who have Write permission, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-111921 is a medium-severity vulnerability in Vikunja that allows project members with Write permission to delete admin-tier link shares. Defenders responsible for Vikunja deployments should assess exposure, verify project member permissions, and prioritize upgrading to a fixed version.

• Potential revocation of admin links
• Invalidation of existing share sessions
• Need for verification of project member permissions
• Priority for upgrading to a fixed version of Vikunja

Technical summary

The vulnerability is caused by an incorrect authorization check in Vikunja versions 0.13.0 before 2.7.0, allowing project members with Write permission to delete admin-tier link shares. This can be exploited by sending DELETE requests to the projects shares endpoints with sequential share IDs, potentially revoking admin links and invalidating existing share sessions. Defenders should prioritize verifying and upgrading to a fixed version of Vikunja, as well as reviewing and restricting project member permissions to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of Vikunja, as well as reviewing and restricting project member permissions.

Recommended defensive actions

• Verify and upgrade to a fixed version of Vikunja
• Review and restrict project member permissions
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or affected systems is limited. Defenders should verify the vulnerability's impact on their systems, review project member permissions, and assess exposure. The CVE Program and NVD entries offer initial insights, but further verification tasks are needed due to limited source detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.