CVE-2026-91984 in Vikunja
요약
\~에 의해 MITRE • 2026. 09. 15.
Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.