EUVD-2026-14927
GHSA-f95f-77jx-fcjc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the DELETE /api/v1/projects/:project/shares/:share endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID. Version 2.2.1 patches the issue.
AnalysisAI
Vikunja prior to version 2.2.1 contains an authorization bypass vulnerability in the DELETE /api/v1/projects/:project/shares/:share endpoint that fails to verify link share ownership. An attacker with administrative access to any project can delete link shares from arbitrary other projects by combining their own project ID with a target share ID, effectively allowing cross-project share manipulation. This is a privilege escalation and denial-of-service vector affecting self-hosted Vikunja deployments where multiple projects exist.
Technical ContextAI
Vikunja is an open-source, self-hosted task management platform written in Go (referenced via CPE cpe:2.3:a:go-vikunja:vikunja). The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), where the REST API endpoint fails to enforce proper authorization checks. The vulnerable endpoint accepts a project ID and share ID as path parameters but does not validate that the specified share actually belongs to the specified project before processing the DELETE request. This is a classic server-side authorization flaw where an authenticated user (with admin privileges on at least one project) can manipulate object references across security boundaries. The Go codebase likely lacks proper authorization middleware or object ownership validation in the share deletion handler.
RemediationAI
Immediately upgrade Vikunja to version 2.2.1 or later, which includes the authorization verification fix for the DELETE /api/v1/projects/:project/shares/:share endpoint. Refer to the official GitHub security advisory at https://github.com/go-vikunja/vikunja/security/advisories/GHSA-f95f-77jx-fcjc for patch details and deployment instructions. Until patching is feasible, mitigate by restricting administrative project access to trusted users only, auditing project share configurations regularly, and implementing network-level access controls to the Vikunja API (e.g., VPN, IP allowlisting, reverse proxy authentication). Monitor API logs for suspicious DELETE requests to the shares endpoint from unexpected project IDs.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today