Listen to this Post
In Vikunja v2.6.0, the project permission engine evaluates a user’s effective permissions across a tree structure using a recursive Common Table Expression (CTE) with a MAX aggregation function. This logic calculates permissions by taking the highest privilege level found anywhere along the accessible project path, including inherited ancestor grants. Consequently, when a project owner intentionally restricts a collaborator on a child sub-project to a lower permission level—such as read-only—after granting them a higher administrative privilege on the parent project, the recursive evaluation engine incorrectly overrides and discards the explicit down-restriction. Instead of enforcing the intended restriction, the system silently assigns the higher inherited parent permission to the child node. This behavior regression allows a user who was deliberately restricted to a read-only sub-project to perform administrative tasks, including modifying, deleting, or re-sharing the sensitive project with arbitrary third parties.
DailyCVE Form:
Platform: Vikunja
Version: 2.6.0
Vulnerability : CWE-269
Severity: Critical
date: 2026-09-07
Prediction: 2026-09-21
What Undercode Say:
curl -s -X POST http://localhost:3456/api/v1/login -H 'Content-Type: application/json' \
-d '{"username":"admin","password":"VikunjaLab123!"}'
curl -s -X PUT http://localhost:3456/api/v1/projects/19/users -H 'Content-Type: application/json' \
-H 'Authorization: Bearer <admin-token>' -d '{"username":"alice","permission":0}'
How Exploit: (Educational Purposes!)
- Authenticate as the project owner and create a parent project alongside a sensitive child sub-project.
- Grant the target collaborator a high administrative permission (ADMIN/2) on the parent project.
- Explicitly assign a lower permission (READ/0) to the same collaborator on the child sub-project to enforce an intended down-restriction.
- Exploit the recursive permission engine flaw by performing administrative actions (such as granting admin rights to a third party or modifying content) on the read-restricted child project.
- Observe that the engine evaluates permissions using MAX aggregation, causing the child’s explicit read-only restriction to be bypassed by the parent’s elevated inheritance rights.
Protection: from this CVE
Upgrade Vikunja to a patched version where permission resolution correctly respects nearest-ancestor-grant-wins or explicit child-level down-restrictions.
Modify the recursive CTE logic in the project access model to avoid unconditional MAX aggregation overrides when explicit lower restrictions are defined on descendants.
Conduct regular access control audits and implement strict object-level authorization checks.
Impact:
This vulnerability results in broken access control and improper privilege management (CWE-269). It defeats owner-configured security restrictions on nested projects, allowing users restricted to read-only access on sensitive sub-projects to execute administrative operations, tamper with protected contents, delete resources, and escalate privileges by re-sharing projects with unauthorized third parties.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
