CVE-2026-111918

Name of the Vulnerable Software and Affected Versions Vikunja versions 1.0.0-rc0 through 2.6.9

Description An improper authorization issue exists in the RecalculateTaskPositions() function. This allows authenticated users who have no accessible projects to write task positions rows for all tasks across the entire instance. An attacker can exploit this by deleting their Inbox after repointing the default project id variable, and subsequently creating saved filters with empty filters to maintain cross-tenant references, which can be used to amplify writes and cause a denial of service.

Recommendations Update to version 2.7.0 or later.