Vikunja 2.6.0 implements a broken access control mechanism when resolving a user's effective project permission. The getProjectAccessForUser function computes the maximum permission across the project tree, thereby silently overriding any explicit, lower‑level permissions set on sub‑projects. As a result, a user who has write access on a parent project but only read‑only access on a child project can modify the child’s tasks and other content. The vulnerability allows unauthorized modification of project data, which can compromise data integrity and confidentiality within the application.

Vikunja version 2.6.0 as distributed by the official vendor, identified by the product name Vikunja and the vendor name go-vikunja. No additional sub‑versions or forks are listed, and the vulnerability applies to any installation of this released version that has not been patched or upgraded.

The CVSS score for this issue is 5.3, placing it in the medium severity range. EPSS is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access: a collaborator with write permissions on a parent project can exploit the flaw. The vulnerability is likely to affect networks hosting an internal or moderately exposed Vikunja instance where users are granted broad project access. The compromise could lead to unintended modification of project data, but it does not provide remote code execution or system‑wide privileges. The conditions for exploitation are limited to existing write permissions, making the risk moderate under typical use cases.