CVE-2026-76216High· 7.5▾ TwilightVikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
code.vikunja.io/api <= 2.4.0Connected by shared product, vendor, weakness, or advisory.
GHSA-9xwc-vwww-qqmwHigh· 7.5Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
CVE-2026-68582Medium· 6.5Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks)
CVE-2026-111918Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
CVE-2026-111921Medium· 5.4Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
GHSA-fprf-r6rv-xg99Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
GHSA-hjx8-qv73-f7cmMedium· 6.5Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed