The vulnerability in Vikunja allows an authenticated user who holds Write permission on a project to delete administrator‑tier link shares. By sending DELETE requests to the v1 or v2 share endpoints with sequential share identifiers, the attacker can revoke admin links and invalidate any active share sessions. This flaw results in unauthorized removal of privileged links and can be considered a privilege escalation vulnerability as defined by CWE‑863.

Vikunja, the open‑source project management application, is affected in all releases starting at version 0.13.0 up to but not including 2.7.0. The affected versions are listed as Vikunja 0.13.0 through 2.6.x. No specific patch version is mentioned for earlier versions, so all versions in this range are vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The Exploit Prediction Scoring System does not report a value, so the likelihood of exploitation is currently unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers need only an authenticated session with Write access on a project and must issue HTTP DELETE requests to the share API endpoints. The attack can be carried out remotely over the public API, making the risk quite tangible for organizations that expose these endpoints.