Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111918 · Microsoft / collected KEV context

EUVD-2026-103303

GHSA-mjqg-gwhm-xr66

GHSA-fprf-r6rv-xg99

GO-2026-6731

cve-program · CVE-2026-111918

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99
• https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation

euvd · EUVD-2026-103303

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99
• https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation

nvd · CVE-2026-111918

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99
• https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation

osv · GHSA-fprf-r6rv-xg99

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99
• https://github.com/go-vikunja/vikunja/commit/24e4563a547be182b338be2f614df339a64a6058
• https://github.com/go-vikunja/vikunja
• https://github.com/go-vikunja/vikunja/releases/tag/v2.7.0

osv · GO-2026-6731

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99

• Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants · Source adds a fixed version · 27 Oct 2026