# Vikunja broken access control in project permission inheritance

Source: https://junglewise.ai/threats/vikunja-explicit-lower-permission-share-on-a-sub-project-is-silently-7946a7d0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.4 · Published 2026-10-09

Vikunja is an open-source project and task management application. In version 2.6.0, when a project owner explicitly grants a collaborator a restrictive permission (read-only) on a sensitive sub-project, but that same user has higher admin permission on a parent project, the system silently ignores the lower restriction and grants the higher permission instead. This allows a user restricted to read-only access to modify, delete, or re-share sensitive sub-projects against the owner's intent.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api), [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.4, published 9 October 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) = 2.6.0; Vikunja 2.6.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Downgrade to Vikunja v2.5.0 or earlier, or restrict collaborators with high permissions on parent projects from seeing sensitive child projects until the fix is applied. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Downgrade to Vikunja v2.5.0 or earlier, or restrict collaborators with high permissions on parent projects from seeing sensitive child projects until the fix is applied.

## Technical details

The permission-resolution query in pkg/models/project_access.go uses MAX(permission) across the project tree, causing inherited permissions from parent projects to always override explicit child grants when lower. The vulnerability requires the attacker to already hold a higher permission on an ancestor project; the impact is that explicit down-restrictions on child projects are silently defeated, allowing unintended modification, deletion, and re-sharing of restricted sub-projects. This is a regression from v2.5.0, which used nearest-ancestor-grant semantics that honored explicit child permissions.

## Affected products

- Vikunja Vikunja 2.6.0

## Timeline

- 2026-10-09: disclosed

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)