Go/code.vikunja.io/api CVE-2026-111920: medium 5.4

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

Action: No fix published. Pin and monitor.

Affected

No affected ranges in the source.

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-pjr3-86v4-5p7w
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w
• https://github.com/go-vikunja/vikunja

CVE-2026-111920 · published 2026-10-09T20:57:44Z · modified 2026-10-19T21:40:55.107455187Z · JSON