CVE-2026-111920
2 advisories.
Go/code.vikunja.io/api CVE-2026-111920: medium 5.4
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
Action: No fix published. Pin and monitor.
Affected
No affected ranges in the source.
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-pjr3-86v4-5p7w
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w
- https://github.com/go-vikunja/vikunja
CVE-2026-111920 · published · modified · JSON
Go/code.vikunja.io/api CVE-2026-111920: medium 4.3
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.i
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-6745
- nvd: CVE-2026-111920
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w
CVE-2026-111920 · published · modified · JSON