[ CVE-2026-76216 · Published 19 Aug 2026 ]
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Packages ]Affected open-source packages
- code.vikunja.io/api goAffected <= 2.4.0 · GHSA-32r8-5843-4qw2