CVE-2026-111918: Incorrect Authorization in go-vikunja vikunja

CVE-2026-111918 is an improper authorization vulnerability in Vikunja's RecalculateTaskPositions feature affecting versions >=1.0.0-rc0 and <2.7.0. Authenticated users without access to any projects can manipulate task_positions data instance-wide. The attack method includes deleting the Inbox after repointing default_project_id and creating empty-filter saved filters to persist cross-tenant references, thereby amplifying write operations and enabling denial of service conditions.

The vulnerability allows authenticated users with no project access to write task_positions rows for all tasks across the instance. This can be exploited to cause denial of service by amplifying write operations through crafted saved filters and Inbox manipulation. There is no indication of privilege escalation beyond this scope or data confidentiality compromise. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions as much as possible and monitor for unusual task_positions write activity. Avoid repointing default_project_id or creating empty-filter saved filters as a temporary mitigation.