{"id":"EUVD-2026-78655","enisaUuid":"1a6bfccc-b620-3d3a-a366-7bdfa7484de7","description":"Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task\u0027s project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.","datePublished":"Sep 15, 2026, 3:18:27 PM","dateUpdated":"Sep 17, 2026, 7:27:58 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w39f-h553-h2mx\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-broken-object-level-authorization-via-task-position\n","aliases":"CVE-2026-91984\nGHSA-ccgq-fx7h-2v4c\nGHSA-w39f-h553-h2mx\n","assigner":"VulnCheck","epss":0.26,"enisaIdProduct":[{"id":"362b7d74-374a-3068-af4b-d2813f7488f0","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"enisaIdVendor":[{"id":"08e1ca90-de4a-345a-ba5b-6cb0f80b9d71","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"7adf1d6e-2b3c-3a2c-a6aa-7eb28914a52d","vulnerability":{"id":"CVE-2026-91984","description":"Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task\u0027s project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.","datePublished":"Sep 15, 2026, 3:18:27 PM","dateUpdated":"Sep 17, 2026, 7:27:58 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w39f-h553-h2mx\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-broken-object-level-authorization-via-task-position\n","enisa_id":"EUVD-2026-78655\n","assigner":"VulnCheck","epss":0.26,"dataProcessed":"Nov 1, 2026, 7:18:05 AM","vulnerabilityProduct":[{"id":"5b0d01a1-217a-38ac-a73d-98ba90ba4cd6","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"vulnerabilityVendor":[{"id":"25fd9bf6-d642-360e-9a16-408e3a16e7af","vendor":{"name":"go-vikunja"}}]}},{"id":"ce8c7003-16a6-3cde-a395-e03ad993df9d","vulnerability":{"id":"GHSA-w39f-h553-h2mx","description":"Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)","datePublished":"Oct 9, 2026, 8:51:41 PM","dateUpdated":"Oct 9, 2026, 8:51:41 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w39f-h553-h2mx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91984\nhttps://github.com/go-vikunja/vikunja/pull/3688\nhttps://github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.6.0\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-broken-object-level-authorization-via-task-position\n","enisa_id":"EUVD-2026-78655\n","aliases":"GHSA-w39f-h553-h2mx\nCVE-2026-91984\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e35fbd2b-7750-3ea8-b62c-59496d4c87f7","vulnerability":{"id":"GHSA-ccgq-fx7h-2v4c","description":"Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)","datePublished":"Sep 15, 2026, 6:32:30 PM","dateUpdated":"Oct 9, 2026, 8:51:34 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w39f-h553-h2mx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91984\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-broken-object-level-authorization-via-task-position\n","enisa_id":"EUVD-2026-78655\n","aliases":"GHSA-ccgq-fx7h-2v4c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}