Vikunja CVE-2026-111920

Exploitation requires: (1) the target running the specific vulnerable release Vikunja v2.6.0 (behavior regression not present in v2.5.0); (2) an authenticated user who is an existing collaborator; (3) a project hierarchy where that user holds a HIGHER permission (e.g. write/admin) on a parent project; and (4) an explicit LOWER-permission share (e.g. read-only) deliberately set by the owner on a child sub-project. The flaw only manifests for this down-restriction configuration - if no parent grant exists or the child is not nested, inheritance has nothing higher to override. Limiting factors: a valid account and membership in the shared project tree are mandatory (no anonymous/unauthenticated path), impact is confined to sub-projects the attacker can already reach via the hierarchy, and no cross-user or cross-tenant escalation beyond the misconfigured tree is indicated.

This is a genuine but low-to-moderate priority issue, not a critical remote threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reach and low complexity, but PR:L is decisive: exploitation is only possible for an already-authenticated collaborator who has been deliberately granted differing permissions across a parent/child project hierarchy. Impact is narrow - VC:N/VI:L/VA:N and no scope change (SC:N/SI:N/SA:N) - reflecting that the flaw grants unintended write/modify (and per the advisory, delete and re-share) on a single sub-project rather than system-wide compromise. No EPSS score, KEV listing, or SSVC decision data was provided in the input; absence of these is not evidence of safety but means widespread automated exploitation is not indicated. No public exploit code was provided - only a GHSA advisory with root-cause SQL analysis. Notably, the affected-versions data lists 'fixed in: None', so no patch is confirmed available, which raises residual risk for v2.6.0 operators even though the real-world attack surface (a trusted insider with partial access abusing a permission-inheritance regression) is inherently limited.

An organization self-hosting Vikunja 2.6.0 gives a contractor write/admin access to a parent 'Engineering' project but explicitly down-restricts them to read-only on a sensitive child 'Security Roadmap' sub-project. Because the permission engine resolves the effective right as the maximum over the project tree, the contractor silently inherits the parent's higher permission on the child and can edit, delete, or re-share it (including granting others admin). No public exploit code exists, but the GHSA advisory documents the exact recursive-CTE flaw, making reproduction straightforward for an authenticated user.