# CVE-2026-111918: Vikunja improper authorization in task position recalculation

Source: https://junglewise.ai/threats/cve-2026-111918-vikunja-from-1-0-0-rc0-before-2-7-0-contains-an-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111918 · Severity: medium · CVSS 5.4 · Published 2026-10-17

Vikunja is a task management and project planning platform. An authenticated attacker with no project access can create saved filters that cause the server to write task position records referencing other users' private tasks across the entire instance. This allows an attacker to corrupt task ordering data for denial of service and violate cross-tenant data integrity by creating unauthorized references to tasks they cannot access.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api), [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-111918 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111918 being exploited in the wild.

**How severe is CVE-2026-111918?** Medium severity, with a CVSS score of 5.4, published 17 October 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 1.0.0-rc0 before 2.7.0.

**Is there a fix for CVE-2026-111918?** Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111918 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111918?** Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.0

## Technical details

The RecalculateTaskPositions function fails to enforce project access controls when recalculating task positions for saved filter views. When a user with zero accessible projects creates a saved filter with an empty filter string, the task search query loses its project scope entirely and returns all tasks in the instance. The function then writes task_positions rows referencing these tasks into views owned by the attacker, creating cross-tenant references. The vulnerability requires the attacker to first delete their Inbox after repurposing their default_project_id to any project, which zeroes their accessible projects and enables the attack.

## Affected products

- Vikunja Vikunja 1.0.0-rc0 before 2.7.0

## Identifiers

- CVE-2026-111918
- GHSA-fprf-r6rv-xg99
- GO-2026-6731

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99)
- [https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation](https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)