CVE-2026-111921: Vikunja Auth Bypass Vulnerability

CVE-2026-111921 Overview

CVE-2026-111921 is an incorrect authorization vulnerability [CWE-863] in Vikunja, an open-source task and project management application. Versions from 0.13.0 up to but not including 2.7.0 allow project members holding only Write permission to delete admin-tier link shares. The flaw stems from a permission check that reads an unloaded share object, causing the authorization logic to approve requests it should reject. Attackers authenticated as low-privileged project members can issue DELETE requests to the v1 or v2 project shares endpoints with sequential share identifiers. Successful requests revoke admin link shares and invalidate active share sessions tied to those links.

Critical Impact

Authenticated project members with Write permission can revoke admin-tier link shares and terminate active share sessions, disrupting collaboration workflows.

Affected Products

• Vikunja versions 0.13.0 through versions prior to 2.7.0
• Vikunja REST API v1 projects shares endpoint
• Vikunja REST API v2 projects shares endpoint

Discovery Timeline

• 2026-10-17 - CVE-2026-111921 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111921

Vulnerability Analysis

Vikunja implements link sharing with distinct permission tiers, including an admin tier that grants elevated control over a project. The deletion endpoint enforces authorization by consulting a share object that was never populated from the database. Because the check evaluates default or zero-value fields rather than the actual share record, it fails to distinguish between admin-tier shares and lower-tier shares. A user with Write permission on the parent project therefore passes a check that should be reserved for administrators.

The impact is limited to integrity and availability of the sharing subsystem. Attackers cannot read protected data through this flaw, but they can remove admin link shares and invalidate the share sessions that depend on them. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Root Cause

The delete permission check reads an unloaded share object. Because the object is not hydrated from storage before evaluation, the authorization function cannot compare the requesting user's role against the share's true tier. The check consequently returns an allow decision for any project member with Write permission.

Attack Vector

Exploitation requires network access to the Vikunja API and valid credentials for a project member with Write permission. The attacker enumerates share identifiers sequentially and submits DELETE requests to the v1 or v2 projects shares endpoints. Each successful request removes a share and invalidates any session tokens derived from it. See the GitHub Security Advisory GHSA-fmmf-xq98-g327 for additional technical context.

// Vulnerability mechanism (described in prose)
// The authorization handler invokes a permission check against a share
// struct that has not been loaded from the datastore. The check evaluates
// zero-value fields instead of the real share tier, and Write-level
// project members pass a check intended for admins.

Detection Methods for CVE-2026-111921

Indicators of Compromise

• Unexpected DELETE requests to /api/v1/projects/{id}/shares/{shareID} or the v2 equivalent originating from non-admin accounts.
• Sequential enumeration of share identifiers in a short time window from a single authenticated session.
• Sudden disappearance of admin link shares combined with user reports of invalidated share sessions.

Detection Strategies

• Review Vikunja application logs for DELETE operations against share endpoints and correlate the requesting user's project role.
• Alert when a user without admin tier on a project successfully deletes a share record, which indicates either exploitation or logic abuse.
• Baseline normal share-management activity per project and flag deviations such as bursts of deletions.

Monitoring Recommendations

• Forward Vikunja reverse-proxy and application logs to a centralized logging platform and retain them for post-incident review.
• Monitor HTTP 2xx responses on share deletion endpoints grouped by source user, source IP, and project identifier.
• Track configuration drift in the Vikunja version string to confirm the patched release is deployed across all instances.

How to Mitigate CVE-2026-111921

Immediate Actions Required

• Upgrade Vikunja to version 2.7.0 or later on all self-hosted instances.
• Audit existing link shares for unexpected deletions and recreate admin-tier shares that were removed.
• Rotate any administrative share links that may have been exposed to users with Write permission during the vulnerable window.

Patch Information

The maintainers resolved the issue in Vikunja 2.7.0 by correctly loading the share object before evaluating the delete permission. Upgrade guidance and the full fix are documented in the GitHub Security Advisory GHSA-fmmf-xq98-g327 and the VulnCheck advisory on Vikunja.

Workarounds

• Restrict project membership so that only trusted users receive Write permission until the upgrade is applied.
• Place the Vikunja API behind a reverse proxy that blocks DELETE requests to share endpoints from non-admin accounts where feasible.
• Reduce reliance on admin-tier link shares for sensitive projects until all instances are patched.

# Verify installed Vikunja version and upgrade using Docker Compose
docker exec vikunja /app/vikunja/vikunja version

# Pull the fixed release and recreate the container
docker compose pull vikunja
docker compose up -d vikunja