CVE-2026-111921: vikunja 0.13.0 to before 2.7.0

Affected technology

vikunja · 0.13.0 to before 2.7.0
go-vikunja

Description’s affected range: before 2.7.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as none; integrity and availability impact as low.