Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111920 · Microsoft / collected KEV context

EUVD-2026-103288

GHSA-r72j-vqhw-6264

GHSA-pjr3-86v4-5p7w

GO-2026-6745

cve-program · CVE-2026-111920

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w
• https://www.vulncheck.com/advisories/vikunja-2.6.0-broken-access-control-via-inherited-project-permissions

euvd · EUVD-2026-103288

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w
• https://www.vulncheck.com/advisories/vikunja-2.6.0-broken-access-control-via-inherited-project-permissions

nvd · CVE-2026-111920

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w
• https://www.vulncheck.com/advisories/vikunja-2.6.0-broken-access-control-via-inherited-project-permissions

osv · GHSA-pjr3-86v4-5p7w

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w
• https://github.com/go-vikunja/vikunja/commit/890ca5979d0c770bb5d158362797879c115961af
• https://github.com/go-vikunja/vikunja
• https://vikunja.io/changelog/vikunja-2.7.0-was-released

osv · GO-2026-6745

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w

• Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) · Source adds a fixed version · 28 Oct 2026