CVE-2026-111921
CVE-2026-111921 · Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.
CVSS 5.3 · Moyenne · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
vikunja
- Versions du logiciel
- ≥ 0.13.0, < 2.7.0: Concernée (semver)
- 2.7.0: Non concernée (semver)
Mettez à jour vers 2.7.0