Vikunja EUVD-2026-103289

Requires an authenticated attacker who is already a member of the target project with Write permission (PR:L); the project must have at least one admin-tier link share to delete. The attacker then issues DELETE /api/v1/projects/{project}/shares/{share} or the v2 equivalent (older releases used /lists/{list}/shares/{share}), iterating sequential share IDs. Exploitation is LIMITED by the need for existing Write membership on the specific project - fully read-only members and link-share principals are rejected on deletion, and there is no HTTP update route to abuse. The v2 route is only present in v2.4.0 and later; the v1 route exists from v0.13.0.

This is a medium-severity authorization flaw (vendor CVSS 4.0 base 5.3) whose real-world risk is moderate and bounded, not a high-urgency priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) is internally consistent with the description: exploitation is over the network against the REST API but requires PR:L - an already-authenticated project member holding Write permission - so this is a privilege-boundary/insider issue rather than an anonymous internet-facing bug. Impact is limited to integrity and availability of link shares (VI:L/VA:L) with no confidentiality loss (VC:N): the attacker cannot read data, only revoke admin link shares and invalidate existing share sessions. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and there is no public exploit identified at time of analysis (the reporter verified a live PoC against a local build on 2026-09-07, but that code is not published). The absence of KEV/EPSS/public-POC signals, combined with the PR:L precondition and lack of confidentiality or code-execution impact, points to a low likelihood of widespread opportunistic exploitation; the realistic concern is trust-boundary abuse within multi-member or multi-tenant Vikunja projects.

A user who has been granted only Write (not Admin) permission on a shared Vikunja project sends DELETE requests to the project shares endpoint, iterating sequential share IDs to remove admin-tier link shares they should not control. The maintainer-confirmed root cause is a permission check that reads the Go zero-value (Read) from an unloaded share object and falls through to the project Write check; a live proof of concept exists but is not publicly available, so no weaponized public exploit is in circulation.