Get real-time updates on Telegram
Verified
ghsa:GHSA-FMMF-XQ98-G327: code.vikunja.io/api >= 0.13.0, <= 2.6.0
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check. Affected range: >= 0.13.0, <= 2.6.0.
Affected technology
code.vikunja.io/api · >= 0.13.0, <= 2.6.0
Vendor not specified by the source
Component: Not specified by the source
What an attacker can do
Deletion of another project's shares, or permit the attacker can create a replacement admin share.
- Product
- code.vikunja.io/api
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-09 22:06:25.045838+00:00 UTC
Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-fmmf-xq98-g327.html