Api: Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Vikunja computes task ordering in a shared task_positions table keyed by task and project view. When a saved filter is created with an empty filter string and the requesting user has no accessible projects, the recalculation logic resets project scope to zero and injects the filter string. The subsequent search query loses its project scope filter due to zero accessible projects and an empty filter string, resulting in a full table scan of all tasks. The server then deletes and bulk-inserts task position rows for all tasks across four default views owned by the user, including tasks from other tenants. This leads to cross-tenant data integrity violations and write amplification. The issue is triggered by setting the user's default project ID to a project they cannot access and deleting their Inbox project, resulting in zero accessible projects. Neighboring code paths enforce project access checks, but this recalculation path lacks such gating, violating the invariant that position writes are scoped by project read access.

An authenticated user can cause the server to write task position entries referencing tasks from other tenants, violating tenant data isolation and integrity. This write amplification scales with the total number of tasks in the instance, potentially impacting database performance and storage. Although the attacker cannot read the foreign tasks through normal API endpoints, the cross-tenant writes represent a serious integrity violation. There is no indication of direct confidentiality or availability impact beyond the write amplification and integrity breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid creating saved filters with empty filter strings when having no accessible projects. Additionally, administrators should monitor for unusual task_positions table growth or cross-tenant data anomalies. The vendor advisory or repository should be consulted for updates or official fixes.