SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-91984

MEDIUM · CVSS 4.3 EPSS 0.21% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-15 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

Vikunja versions prior to 2.6.0 are vulnerable due to inadequate validation of the user-supplied project_view_id in task-position requests, allowing authenticated attackers to manipulate task position rows across different tenant project views. This could lead to unauthorized access and data leakage between projects. Organizations using Vikunja should prioritize updating to version 2.6.0 or later to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-91984
Severity
MEDIUM
CVSS
4.3
EPSS
0.21%

Original NVD Description

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.