CVE-2026-111921
Received Received - Intake

Incorrect Authorization in Vikunja Allows Project Members to Delete Admin Link Shares

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111921
EUVD
EUVD-2026-103289

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-vikunja vikunja 0.13.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja versions 0.13.0 to 2.7.0 have an authorization flaw where project members with Write permission can delete admin-tier link shares. The vulnerability occurs because the delete permission check fails to load the share object properly, allowing attackers to send DELETE requests to endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.

Detection Guidance

Check Vikunja server logs for DELETE requests to /v1/projects/{id}/shares or /v2/projects/{id}/shares endpoints with sequential share IDs. Monitor for unauthorized deletion of admin-tier link shares by non-admin users.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to delete critical admin-tier link shares, disrupting project access and collaboration. It may lead to data exposure or loss of shared resources, affecting project integrity and user productivity.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's access controls. Compliance risks include data breaches and failure to protect personal or health information.

Mitigation Strategies

Upgrade Vikunja to version 2.7.0 or later to address the authorization flaw. Review and restrict Write permissions for project members to prevent unauthorized share deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart