Description
Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | 2.6.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | code.vikunja.io/api | >= 2.6.0, < 2.7.0 | 2.7.0 | GHSA-pjr3-86v4-5p7w |
| Go | code.vikunja.io/api | all versions | — | GO-2026-6745 |
References
- GitHub Security Advisory (GHSA-pjr3-86v4-5p7w) vendor-advisory
- VulnCheck Advisory: Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions third-party-advisory