CVE-2026-91984 — Vikunja before 2.6.0 Broken Object-Level Authorization via task-position
Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task positi…
Published: 2026-09-15 · CVSS: 5.3 · CVSS 4.0
Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7