CVE-2026-91984: Go-Vikunja Vikunja

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.

Affected products

• Go-Vikunja Vikunja: before 2.6.0 (fixed in 2.6.0)

Published 2026-09-15. Last modified 2026-09-17.