Api: Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

In Vikunja v2.6.0, the project permission engine calculates a user's effective permission on a project subtree by taking the maximum permission across the entire reachable subtree. This means that if a user has a higher permission on a parent project and a lower explicit permission on a child project, the lower explicit permission is ignored and the user inherits the higher permission. This is a regression from v2.5.0, which used a 'nearest-ancestor-grant-wins' approach that respected explicit lower permissions on child projects. The issue arises from a recursive SQL query that aggregates permissions using MAX(), causing explicit down-restrictions to be silently overridden. As a result, users restricted to read-only on sensitive sub-projects can perform administrative actions, violating intended access controls.

The vulnerability allows users to bypass explicit access restrictions on sub-projects by inheriting higher permissions from parent projects. This can lead to unauthorized modification, deletion, and re-sharing of sensitive sub-projects, including granting administrative rights to other users. The impact is a broken access control and privilege management regression that undermines the security model intended by project owners.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The maintainers may consider this behavior intentional based on code comments, but it is a security-relevant regression. Until an official fix or guidance is provided, users should be cautious when using Vikunja v2.6.0 and consider downgrading to v2.5.0 or implementing external access controls to enforce intended restrictions.