CVE-2026-91984
Received Received - Intake

Unauthorized Task Position Insertion in Vikunja

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91984
EUVD
EUVD-2026-78655

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
vikunja vikunja 2.5.0
vikunja vikunja 2.6.0
vikunja vikunja to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91984 is a Broken Object-Level Authorization (BOLA) vulnerability in Vikunja versions before 2.6.0. It allows authenticated attackers to manipulate the project_view_id parameter in task-position requests. By exploiting this flaw, attackers can insert task position rows into arbitrary project views belonging to other tenants without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your Vikunja instance is running a version before 2.6.0. Use commands like 'curl -s https://your-vikunja-url.com/api/v1/info | grep version' or inspect the version in the application settings. If the version is below 2.6.0, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers with write access to a single task to inject task-position rows into views of other tenants. While the injected rows are invisible to victims and do not grant direct read access or data destruction, it represents an authorization bypass. The impact is rated as low but could become problematic if future read paths join task_positions without rechecking task-project access.

Mitigation Strategies

Upgrade Vikunja to version 2.6.0 or later immediately. This patch addresses the authorization bypass by adding validation for the project_view_id parameter. No temporary workarounds are recommended as the fix is straightforward.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart