Is CVE-2026-111921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111921 being exploited in the wild.

How severe is CVE-2026-111921?

Medium severity, with a CVSS score of 5.4, published 17 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 0.13.0 to 2.6.0.

How is CVE-2026-111921 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111921?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111921: Vikunja incorrect authorization in link share deletion

CVE-2026-111921 · Severity: medium · CVSS 5.4 · Published 2026-10-17

Vikunja is a project management and collaboration tool that manages access to projects through permission tiers and shareable links. A project member with Write permission can delete admin-level access links created by higher-privileged users, revoking external access and invalidating existing sessions for those links. This allows an insider with modest privileges to disrupt administrative access control.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-111921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111921 being exploited in the wild.
How severe is CVE-2026-111921?: Medium severity, with a CVSS score of 5.4, published 17 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 0.13.0 to 2.6.0.
Is there a fix for CVE-2026-111921?: Yes: fixed in 2.7.0. Until then: Restrict write-level project membership to trusted users, and avoid granting Write permissions to members who should not have the ability to revoke administrative access links. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111921 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111921?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.0

Restrict write-level project membership to trusted users, and avoid granting Write permissions to members who should not have the ability to revoke administrative access links.

Technical details

The vulnerability exists in the DELETE handlers for link shares (/api/v1 and /api/v2 projects shares endpoints) due to an unloaded permission check. The authorization logic reads the permission level from a newly instantiated LinkSharing object populated only with URL IDs rather than loading the actual stored share, causing the permission field to default to PermissionRead (zero value) instead of the correct PermissionAdmin tier. This causes the authorization check to fall through to project Write permission instead of requiring Admin, allowing Write-level members to delete admin-tier shares via sequential share ID enumeration.

Affected products

Vikunja Vikunja 0.13.0 to 2.6.0

Identifiers

CVE-2026-111921
GHSA-fmmf-xq98-g327
GO-2026-6730

Timeline

2026-10-03: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.