https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T12:11:03.549236+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-91984 fkie_cve-2026-91984 2026-10-10T12:11:04.999821+00:00

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.

 https://vulnerability.circl.lu/vuln/ghsa-ccgq-fx7h-2v4c Withdrawn: GHSA-ccgq-fx7h-2v4c — Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unval… 2026-10-10T12:11:04.999920+00:00

Withdrawn by the publisher.

Affected: Go: code.vikunja.io/api

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w39f-h553-h2mx. This link is maintained to preserve external references.

### Original Description Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.