PkgSeer

Vulnerability GO-2026-6745

Unknown

5 hours ago

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

v0.13.1 - v0.24.6

Summary

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

Details

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

References

ADVISORY — github.com

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api

v0.13.1 - v0.24.6 GO-2026-6711

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api

v0.13.1 - v0.24.6 GO-2026-6713

Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api

v0.13.1 - v0.24.6 GO-2026-6714

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api

v0.13.1 - v0.24.6 GO-2026-6715

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api

v0.13.1 - v0.24.6 GO-2026-6717

View all vulnerabilities for these packages

Impacted packages

code.vikunja.io/api

Timeline

Published

5 hours ago

Last Modified

4 hours ago