CVE-2026-91984 is an authorization bypass vulnerability in Vikunja prior to version 2.6.0. The flaw arises because the software fails to validate that the user-supplied project_view_id parameter in task-position API requests corresponds to the project of the task being manipulated. As a result, an authenticated attacker with limited privileges can insert task position rows into arbitrary project views belonging to other tenants by sending crafted POST or PUT requests to the task-position endpoints. This vulnerability affects all versions from 0 up to but not including 2.6.0.

An authenticated attacker with limited privileges can manipulate task positions in project views of other tenants, potentially disrupting task organization or workflow in projects they do not own or manage. This could lead to unauthorized data modification within the multi-tenant environment. There is no indication of privilege escalation or data disclosure beyond task position manipulation.

Upgrade Vikunja to version 2.6.0 or later, where this authorization validation issue has been fixed. Since the vulnerability is addressed in the official release 2.6.0, applying this update fully mitigates the risk. No additional vendor advisory or patch links are provided, so users should verify the update availability from the official Vikunja sources.