{"items":[{"id":"NVI-00009172","kind":"vulnerability","title":"Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fmmf-xq98-g327"],"plain_summary":"GitHub lists this reviewed advisory for code.vikunja.io/api. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-dee4ab12c4112f899ead0a73a40f0208"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-dee4ab12c4112f899ead0a73a40f0208","url":"https://github.com/advisories/GHSA-fmmf-xq98-g327","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fmmf-xq98-g327","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:51.534Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-dee4ab12c4112f899ead0a73a40f0208"],"technology":"code.vikunja.io/api","known_exclusions":[],"conditions_summary":"## Summary\n\nA project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project Write permission instead of requiring Admin.\n\n## Details\n\nAffected endpoints:\n\n- `DELETE /api/v1/projects/{project}/shares/{share}`\n- `DELETE /api/v2/projects/{project}/shares/{share}`\n\nOlder v1 releases used `/lists/{list}/shares/{share}` before lists were renamed to projects.\n\nIn `pkg/routes/api/v2/link_sharing.go:156`, the delete handler passes `&models.LinkSharing{ID: in.ID, ProjectID: in.ProjectID}` to `handler.DoDelete`. The v1 generic handler likewise binds the URL IDs without loading the stored share.\n\n`pkg/web/handler/core.go:185` calls `CanDelete` before `Delete`. `LinkSharing.CanDelete` delegates to `canDoLinkShare` in `pkg/models/link_sharing_permissions.go`. That helper loads the project but does not load the link share, then evaluates:\n\n```go\nif share.Permission == PermissionAdmin {\n    return l.IsAdmin(s, a)\n}\nreturn l.CanWrite(s, a)\n```\n\nOn deletion, `share.Permission` is ","public_affected_ranges":[">= 0.13.0, <= 2.6.0"]}],"null_published_at":"2026-10-31T22:13:31.288Z","source_updated_at":"2026-10-27T15:20:15.000Z","source_disclosed_at":"2026-10-09T20:57:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:51.534Z"}],"next_cursor":null,"snapshot_revision":"42594"}