Is CVE-2026-111918 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111918 being exploited in the wild.

How severe is CVE-2026-111918?

Medium severity, with a CVSS score of 5.4, published 17 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 1.0.0-rc0 before 2.7.0.

Is there a fix for CVE-2026-111918?

Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111918 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111918?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111918: Vikunja improper authorization in task position recalculation

CVE-2026-111918 · Severity: medium · CVSS 5.4 · Published 2026-10-17

Vikunja is a task management and project planning platform. An authenticated attacker with no project access can create saved filters that cause the server to write task position records referencing other users' private tasks across the entire instance. This allows an attacker to corrupt task ordering data for denial of service and violate cross-tenant data integrity by creating unauthorized references to tasks they cannot access.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-111918 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111918 being exploited in the wild.
How severe is CVE-2026-111918?: Medium severity, with a CVSS score of 5.4, published 17 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 1.0.0-rc0 before 2.7.0.
Is there a fix for CVE-2026-111918?: Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111918 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111918?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.0

Technical details

The RecalculateTaskPositions function fails to enforce project access controls when recalculating task positions for saved filter views. When a user with zero accessible projects creates a saved filter with an empty filter string, the task search query loses its project scope entirely and returns all tasks in the instance. The function then writes task_positions rows referencing these tasks into views owned by the attacker, creating cross-tenant references. The vulnerability requires the attacker to first delete their Inbox after repurposing their default_project_id to any project, which zeroes their accessible projects and enables the attack.

Affected products

Vikunja Vikunja 1.0.0-rc0 before 2.7.0

Identifiers

CVE-2026-111918
GHSA-fprf-r6rv-xg99
GO-2026-6731

Timeline

2026-10-03: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.