Vikunja versions from 1.0.0‑rc0 up to 2.6.x include an improper authorization flaw in the RecalculateTaskPositions routine. Authenticated users who have no accessible projects can write task_positions rows for every task instance. This flaw enables the attacker to reposition tasks across all tenants, delete the Inbox by repointing default_project_id, and create empty saved filters that persist cross‑tenant references. The resulting write amplification can corrupt or delete task data, effectively causing a denial of service.

The affected product is Vikunja published by the go‑vikunja vendor, covering releases from 1.0.0‑rc0 through any build before 2.7.0. All builds in that range should be considered vulnerable if the vulnerable code path remains present.

The CVSS score of 5.3 indicates moderate severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only authentication and no project access; an attacker can trigger the flaw by creating saved filters and manipulating project defaults. Successful use of the vulnerability can result in cross‑tenant data tampering, disruption of task management, and potential service interruption.