CVE-2026-111920: Improper Privilege Management in go-vikunja vikunja

CVE-2026-111920 describes a broken access control vulnerability in Vikunja version 2.6.0. The issue lies in the getProjectAccessForUser function within pkg/models/project_access.go, which incorrectly calculates a user's effective permissions by taking the maximum permission level across the project hierarchy. This behavior silently overrides explicit lower-permission shares on sub-projects, allowing users with write access on a parent project to escalate their permissions on child projects where they should have read-only access, enabling unauthorized modifications.

An attacker or collaborator with write access on a parent project can modify tasks and content in child projects where they should only have read access. This can lead to unauthorized changes, data integrity issues, and potential disruption of project workflows. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity impact with network attack vector and low complexity.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access on parent projects carefully and monitor project permission assignments to minimize risk.