Improper Authorization in Vikunja Leading to Denial of Service

Executive Summary

CVE-2026-111918 is an improper authorization flaw in Vikunja versions 1.0.0-rc0 through 2.6.0. It allows authenticated users with no project access to write task position records for all tasks across the entire instance. The issue occurs when creating saved filters with empty filter strings, causing the system to lose project scope and return all tasks. This leads to unauthorized writes to task position data, including tasks from other tenants, enabling cross-tenant integrity violations and potential denial of service.

Useful 0 Not Useful 0

Detection Guidance

Check Vikunja versions between 1.0.0-rc0 and 2.6.0 for the vulnerability. Monitor for unusual task position writes or cross-tenant data access in logs. Look for saved filters with empty filter strings created by users with no project access.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write task position data for all tasks in the system, including those they cannot access. This may cause denial of service by overwhelming the system with write operations. The impact scales with the instance size, requiring minimal effort from the attacker. Users might experience system slowdowns or crashes due to the amplified write operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to task data across tenants, violating data isolation principles required by GDPR and HIPAA. Cross-tenant integrity violations may result in unauthorized data exposure or modification, compromising compliance with these regulations. The improper authorization flaw undermines access control mechanisms central to maintaining regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.7.0 or later immediately. Review and remove any suspicious saved filters with empty filter strings. Audit task position writes and cross-tenant references in logs.

Useful 0 Not Useful 0