How to use this reference
Editorial lesson: saved associations express preference, not continuing authority. Every query branch returning an object should enforce its current authorization policy, including alternate views and aggregates. The advisory lists 2.6.0 as patched; the August 31, 2026 maintainer release article separately confirms this revocation issue was fixed.
Before reading
- Basic server-side authorization and persistent-state concepts
Context and limits
- Requires prior write-level sharing and a favorite saved while authorized, followed by revocation. The advisory lists versions through 2.5.0 as affected and reports runtime verification on 2.5.0.
- Reported observation: titles and descriptions edited after revocation remained readable. Impact is read-only and limited to previously favorited tasks; it does not establish access to all project tasks or a production incident.
- Published August 31, 2026 by kolaente; JellowBeanz26 is credited as reporter. Software release 2.6.0 was announced the same day in the separate maintainer article; this is not a resource-edition date.
- The advisory proposes current-access filtering and/or favorite cleanup. Neither reviewed source establishes the exact implemented combination, so these proposals are not represented as verified patch internals.
Sources and provenance
- Favorited tasks remain readable after project access is revoked Vikunja · reviewed 2026-10-03
- Vikunja 2.6.0: Eighteen security fixes, Planka import, and attachment previews Vikunja · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot d5550c789111. Open the complete JSON contract.