cyfenced.com →

[ CVE-2026-68581 · Published 2 Aug 2026 ]

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

CVSS 8.1 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Fixed in version 2.4.0.

[ Fixes ]Fixes and patches

  • code.vikunja.io/api 2.4.0Fixed version · GitHub Advisories · go package code.vikunja.io/api: upgrade to 2.4.0 or later (affected >= 0.22.0, <= 2.3.0)

[ Packages ]Affected open-source packages

[ References ]References