CVE-2026-111918 Overview
CVE-2026-111918 is an improper authorization vulnerability [CWE-863] in Vikunja, an open-source task management application. The flaw resides in the RecalculateTaskPositions function and affects versions from 1.0.0-rc0 before 2.7.0. Authenticated users with zero accessible projects can write task_positions rows for all tasks across the entire instance. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.
Critical Impact
Authenticated low-privileged users can perform cross-tenant writes to task position data and trigger denial of service through write amplification against the Vikunja database.
Affected Products
- Vikunja versions 1.0.0-rc0 through versions prior to 2.7.0
- Self-hosted Vikunja instances with multi-tenant usage
- Vikunja deployments permitting authenticated user registration
Discovery Timeline
- 2026-10-17 - CVE-2026-111918 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-111918
Vulnerability Analysis
The vulnerability lies in Vikunja's RecalculateTaskPositions routine, which recalculates ordering values stored in the task_positions table. The function fails to enforce proper authorization boundaries between tenants. An authenticated user with no accessible projects can still trigger writes affecting every task in the instance.
The exploitation chain combines several design weaknesses. An attacker first repoints default_project_id to a project they can influence. They then delete their Inbox, which normally bootstraps project access. By creating a saved filter with an empty filter expression, the attacker establishes a persistent cross-tenant reference. When the position recalculation routine executes, it iterates over tasks belonging to other tenants and writes rows on their behalf.
Root Cause
The root cause is a missing authorization check in RecalculateTaskPositions. The function trusts the caller's filter scope rather than verifying ownership of each target task. Combined with saved filters that accept empty expressions, the function enumerates and writes to records outside the caller's tenant boundary. See the GitHub Security Advisory GHSA-fprf-r6rv-xg99 for upstream analysis.
Attack Vector
Exploitation requires network access to the Vikunja API and valid authenticated credentials. No user interaction is required beyond the attacker's own session. The attacker modifies the default_project_id setting on their account, deletes their Inbox project, and submits a saved filter with no filter clause. Subsequent calls that trigger position recalculation produce writes against unrelated tenants, enabling data integrity impact on task_positions records and denial of service through amplified database writes. Technical analysis is available in the VulnCheck Advisory for Vikunja.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-111918
Indicators of Compromise
- Accounts with default_project_id repointed to projects outside their normal access scope.
- Deleted Inbox projects on user accounts that remain active.
- Saved filters created with empty or null filter expressions.
- Spikes in write activity against the task_positions database table from low-privileged user sessions.
Detection Strategies
- Audit API logs for sequences combining default_project_id updates, Inbox deletion, and saved filter creation.
- Correlate authenticated API calls with database row counts affected in task_positions.
- Flag any user session producing writes to task position data for tasks the user does not own.
Monitoring Recommendations
- Monitor Vikunja application logs for repeated calls to the task position recalculation endpoint.
- Track database query volume and row-write counts per authenticated session.
- Alert on sudden growth in the saved_filters table where filter conditions are empty strings.
How to Mitigate CVE-2026-111918
Immediate Actions Required
- Upgrade Vikunja to version 2.7.0 or later on all self-hosted instances.
- Review existing saved filters and remove any with empty filter expressions.
- Audit user accounts for abnormal default_project_id values and restore Inbox projects where missing.
- Restrict new user registration on public-facing instances until patching is complete.
Patch Information
Vikunja version 2.7.0 resolves CVE-2026-111918 by enforcing authorization checks in RecalculateTaskPositions and rejecting saved filters with empty filter expressions. Administrators should apply the fixed release referenced in the GitHub Security Advisory GHSA-fprf-r6rv-xg99.
Workarounds
- Disable self-service account registration to limit the attacker population to vetted users.
- Implement application-layer rate limiting on endpoints that trigger task position recalculation.
- Restrict saved filter creation through a reverse proxy rule that validates non-empty filter payloads.
- Place the Vikunja API behind authentication-aware access controls until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
