CVE-2026-68581High· 8.1▾ TwilightVikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a lin…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Fixed in version 2.4.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
code.vikunja.io/api >= 0.22.0, <= 2.3.0Patched in:
code.vikunja.io/api 2.4.0Connected by shared product, vendor, weakness, or advisory.
GHSA-9jrx-vmh8-c6xwHigh· 8.1Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
CVE-2026-68582Medium· 6.5Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks)
CVE-2026-111918Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
CVE-2026-111921Medium· 5.4Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
CVE-2026-57458High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-62367High· 7.5Vikunja is an open-source self-hosted task management platform