{"id":"GHSA-mjqg-gwhm-xr66","revision":null,"records":[{"revision":"3f9dc2ac432946a7874c95fdbd24db7d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111918","aliases":[],"title":"Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation","description":"Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.","state":0,"publishedAt":"2026-10-17T18:46:33.245+00:00","modifiedAt":"2026-10-19T16:39:37.953+00:00","affected":[{"ecosystem":"Vendor product","name":"vikunja","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"go-vikunja\",\n                    \"product\": \"vikunja\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/code.vikunja.io/api\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.0.0-rc0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.7.0\"\n                        },\n                        {\n                            \"version\": \"2.7.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99","https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111918","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111918","identifiers":["CVE-2026-111918"]},"retained":false,"historicalAffected":[]},{"revision":"b97baddf5e744322b7e2fac186215ecf","observedAt":"2026-10-30T01:56:39.541+00:00","statement":{"source":"euvd","id":"EUVD-2026-103303","aliases":["CVE-2026-111918","GHSA-mjqg-gwhm-xr66"],"title":"Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attacke…","description":"Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3,"severity":null}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99","https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103303","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 17, 2026, 6:46:33 PM","dateUpdated":"Oct 19, 2026, 4:39:37 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-103303","identifiers":["EUVD-2026-103303","CVE-2026-111918","GHSA-mjqg-gwhm-xr66"]},"retained":false,"historicalAffected":[]},{"revision":"8721a928500040d3ad9659a46b4603c0","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-111918","aliases":[],"title":"Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attacke…","description":"Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.","state":0,"publishedAt":"2026-10-17T19:16:34.403+00:00","modifiedAt":"2026-10-19T21:14:14.15+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99","https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111918","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-10-17T19:16:34.403","lastModified":"2026-10-19T21:14:14.150"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-111918","identifiers":["CVE-2026-111918"]},"retained":false,"historicalAffected":[]},{"revision":"63ab752c4870496f819cc435e249193a","observedAt":"2026-10-27T15:46:08.811+00:00","statement":{"source":"osv","id":"GHSA-fprf-r6rv-xg99","aliases":["CVE-2026-111918","GO-2026-6731"],"title":"Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants","description":"### Summary\n\nIn Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the instance. The server then writes one `task_positions` row per task per view (four views per filter) into views owned by the requesting user, including rows that reference tasks of other tenants the user can never see. Any authenticated user can trigger this. The impact is a cross-tenant integrity violation, a single-request write amplification primitive that scales with instance size, and a violation of the invariant stated in the fix for GHSA-w39f-h553-h2mx that position writes are scoped by project read access.\n\n### Details\n\nVikunja computes kanban and list ordering in a shared `task_positions` table keyed by `(task_id, project_view_id)`. When a saved filter is created, `SavedFilter.Create` (`pkg/models/saved_filters.go:130`) calls `CreateDefaultViewsForProject` (`pkg/models/project_view.go:816`) which, for every default view it creates, calls `RecalculateTaskPositions` with `addExistingTasksToView = true` (`pkg/models/project_view.go:447`).\n\n`RecalculateTaskPositions` (`pkg/models/task_position.go:312`) builds a `TaskCollection` and, for filter views (`view.ProjectID < -1`), resets the project scope to zero and injects the saved filter's filter string. The scope of the subsequent search is derived from `getRelevantProjectsFromCollection` (`pkg/models/task_collection.go:188`), which for `ProjectID == 0` returns exactly the projects the requesting user can access.\n\nInside `dbTaskSearcher.Search` (`pkg/models/task_search.go`), the WHERE clause is assembled at line 632:\n\n```go\ncond := builder.And(builder.Or(projectIDCond, favoritesCond), where, filterCond)\n```\n\n`projectIDCond` is only set when `len(opts.projectIDs) > 0` and `favoritesCond` only when the caller opted into the favorites arm, which `RecalculateTaskPositions` never does. With zero accessible projects, an empty filter string (which produces no filter condition in `getTaskFiltersFromFilterString`) and no search string, all four children of the `builder.And` are invalid. go-xorm's condition builders silently drop invalid children, so the query becomes `SELECT ... FROM tasks` with no WHERE clause at all.\n\nThe result is written back unconditionally: the function deletes the view's position rows and bulk-inserts one row per returned task per view. Because the filter creation path runs this for four default views, one request writes `4 x total_task_count` rows, every one of them referencing tasks the requesting user has no relationship with, including tasks in other users' private projects.\n\nReaching the zero-project precondition does not require any bug beyond this one. `UpdateUserGeneralSettings` (`pkg/models/user_settings.go:105`) assigns `default_project_id` from the request body without validating that the referenced project exists or belongs to the caller. A user can therefore point their default project at any project id, which unblocks deleting their own Inbox (deletion is refused only while the Inbox is the default project, error 3012 in `pkg/models/error.go:482`). After the Inbox is gone, `getRawProjectsForUser` returns an empty list.\n\nTwo neighboring controls confirm the intended invariant exists elsewhere and is enforced in sibling paths. The event-driven filter update path gates candidate filters on the filter owner's access to each task's project (`matchTasksToViewsOfFilter`, introduced by commit `b1ad4063e7`), and the fix for GHSA-w39f-h553-h2mx validates position target views. The recalculation path on filter creation has no equivalent gate and contradicts the advisory statement that recalculation \"aborts on its own project read-access check\".\n\n### PoC\n\n> [vikunja-filter-empty-scope-cross-tenant-positions-PoC.zip](https://github.com/user-attachments/files/32740623/vikunja-filter-empty-scope-cross-tenant-positions-PoC.zip)\n\nThe attached archive contains `deployment/deploy.sh` (local Vikunja v2.6.0 on loopback with SQLite) and `poc/poc.sh`, which performs the full sequence:\n\n1. Victim registers, creates a private project and a task.\n2. Attacker registers, sets `default_project_id` to the victim's project via `PUT /api/v2/user/settings/general`, deletes their own Inbox, and now has zero accessible projects.\n3. Control: `GET /api/v2/projects/{victim}` returns 403.\n4. Attacker creates a saved filter with `{\"filter\":\"\",\"filter_include_nulls\":true}`.\n5. Verification: direct SQLite inspection shows `task_positions` rows referencing the victim's task in all four of the attacker's filter views.\n6. Control: `GET /api/v2/projects/{filter_pseudo_project}/tasks` returns 0 items, so the written rows are not readable back through collection endpoints.\n\nResult: 10 checks passed on two consecutive runs, each from a wiped database.\n\n### Impact\n\nAn authenticated user, even one with no project access at all, causes the server to persist cross-tenant references: rows pointing at arbitrary other users' tasks are written into views the attacker controls. Task content is not exposed through the documented read paths (verified), so this is an integrity and availability issue rather than a direct disclosure:\n\n- Cross-tenant integrity violation. The `task_positions` state of the attacker's views now encodes other tenants' objects, against the access model the rest of the code enforces.\n- Write amplification and denial of service. One cheap request performs a full-table scan plus `4 x N` inserts, where N is the number of tasks in the instance. On an instance with 100,000 tasks that is 400,000 rows per request, and the request can be repeated without bound. CPU, IO and storage costs scale with instance size while attacker cost stays constant.","state":0,"publishedAt":"2026-10-09T20:57:38+00:00","modifiedAt":"2026-10-27T15:30:03.5353063+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0-rc0"},{"kind":"fixed","version":"2.7.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99","https://github.com/go-vikunja/vikunja/commit/24e4563a547be182b338be2f614df339a64a6058","https://github.com/go-vikunja/vikunja","https://github.com/go-vikunja/vikunja/releases/tag/v2.7.0"],"sourceUrl":"https://github.com/advisories/GHSA-fprf-r6rv-xg99","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fprf-r6rv-xg99","identifiers":["GHSA-fprf-r6rv-xg99","CVE-2026-111918","GO-2026-6731"]},"retained":false,"historicalAffected":[]},{"revision":"385c8dfff58f4c52a306b7e7a2f57bcd","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6731","aliases":["CVE-2026-111918","GHSA-fprf-r6rv-xg99"],"title":"Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api","description":"Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .","state":0,"publishedAt":"2026-10-19T21:08:26+00:00","modifiedAt":"2026-10-19T21:40:46.828122+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6731","license":"OSV · upstream source license applies","key":"osv:GO-2026-6731","identifiers":["GO-2026-6731","CVE-2026-111918","GHSA-fprf-r6rv-xg99"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T16:47:08.0799506+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T16:47:08.0799506+00:00","lastSuccessAt":"2026-10-30T16:47:08.2603913+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.2603923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-d7b222ecfb3b37ed75e1512e40fdcf28594abff2a8568f1274ffe87891d61caa","complete":true,"records":417228,"lastAttemptAt":"2026-10-30T16:45:32.5536592+00:00","lastSuccessAt":"2026-10-30T16:45:32.4100997+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:45:32.5536592+00:00","snapshotPublishedAt":"2026-10-30T16:25:31+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-487f1b7b631f49f297d2991d50047d8c","complete":false,"records":13527,"lastAttemptAt":"2026-10-30T16:52:45.8142528+00:00","lastSuccessAt":"2026-10-30T16:52:45.8751834+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:52:45.8751834+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T16:47:08.0799506+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T16:47:08.0799506+00:00","lastSuccessAt":"2026-10-30T16:47:08.2616584+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.2616589+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0f2f428ccf42491d9927e55626b8fc62","complete":false,"records":13545,"lastAttemptAt":"2026-10-30T16:47:33.5927086+00:00","lastSuccessAt":"2026-10-30T16:47:33.589+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:33.589+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13603,"expectedIdentifiers":13605,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-e091d9104aae1991994c868b5fad0248c9b288abafb7672fca8ae6500f97e080","complete":true,"records":9808,"lastAttemptAt":"2026-10-30T16:47:08.0351821+00:00","lastSuccessAt":"2026-10-30T15:47:48.5635219+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.0351821+00:00","snapshotPublishedAt":"2026-10-30T15:23:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T16:45:32.7049631+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:45:32.7049631+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f63fa91e750071ae88c9f82019ecd6c982fa4fcc1d3dc5ceb5d9c642fb6bf05c","complete":true,"records":3023,"lastAttemptAt":"2026-10-30T16:47:08.0492653+00:00","lastSuccessAt":"2026-10-30T11:49:36.4759887+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.0492653+00:00","snapshotPublishedAt":"2026-10-30T11:18:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5a294989873fb9168d8ae38882a7a1451dd62315f67b71899ceec86dfb29d13b","complete":true,"records":230954,"lastAttemptAt":"2026-10-30T16:47:07.9043788+00:00","lastSuccessAt":"2026-10-30T16:47:06.5719002+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:07.9043788+00:00","snapshotPublishedAt":"2026-10-30T16:33:30+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}