# Vikunja saved filter creation cross-tenant task position write

Source: https://junglewise.ai/threats/vikunja-saved-filter-creation-with-an-empty-filter-string-recalculates-6db7ee4f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.4 · Published 2026-10-09

Vikunja, an open-source task management and project planning application, allows authenticated users to create saved filters that trigger automatic task position recalculations. A flaw in this feature causes the position data to be written across tenant boundaries when a user has no accessible projects, allowing any user to insert references to other users' private tasks into their own views. While task content is not directly exposed, this creates a data integrity violation and enables denial-of-service through write amplification.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api), [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.4, published 9 October 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) >= 1.0.0-rc0, <= 2.6.0; Vikunja v2.6.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the SavedFilter.Create path which calls RecalculateTaskPositions with an empty or restricted filter scope. When the requesting user has zero accessible projects, the TaskCollection query builder silently drops all WHERE conditions (due to go-xorm's behavior with invalid conditions), resulting in a full table scan of all tasks across all tenants. The position recalculation then writes one task_positions row per returned task per view (four views per filter), creating cross-tenant references that violate the project read-access invariant enforced elsewhere in the codebase.

## Affected products

- Vikunja Vikunja v2.6.0

## Timeline

- 2026-10-09: disclosed

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)