Skip to main content

Vikunja CVE-2026-68581

| EUVDEUVD-2026-51991 HIGH
Incorrect Authorization (CWE-863)
2026-08-02 VulnCheck GHSA-9jrx-vmh8-c6xw
Authentication Bypass Vikunja
8.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.8 MEDIUM

Network-accessible endpoint requires authenticated low-privilege account and sequential link-share ID enumeration to achieve collision (AC:H); full confidentiality and integrity impact via API token takeover; no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 02, 2026 - 13:06 vuln.today
Analysis Generated
Aug 02, 2026 - 13:06 vuln.today
CVE Published
Aug 02, 2026 - 12:15 cve.org
HIGH 8.6

DescriptionCVE.org

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Fixed in version 2.4.0.

AnalysisAI

Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully control any target user's API token management by exploiting a numeric ID collision between the independent link-share and user ID sequences. The /api/v1/tokens endpoints resolve the caller identity exclusively via the generic web.Auth.GetID() interface without validating whether the authenticated principal is a user or a link-share, meaning a link-share JWT whose integer ID equals a victim's user ID is accepted as that user's credential. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low-privilege Vikunja account
Delivery
Query user search API to obtain target's numeric ID
Exploit
Create link shares on attacker-owned project until link-share sequence reaches target ID
Execution
Extract link-share JWT with matching numeric ID
Persist
Call /api/v1/tokens endpoints using link-share JWT as victim
Impact
Issue new API token with attacker-chosen scopes under victim identity
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid, authenticated Vikunja user account with write access to at least one project (required to create link shares). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.6 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N reflects the high-impact outcome once the ID collision is achieved, and the network-accessible attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated attacker with a low-privilege Vikunja account uses the authenticated user search API to identify a target user's numeric ID - for example, ID 7. The attacker then creates link shares on a project they own in a loop until the link-share auto-increment sequence assigns ID 7 to a new share, then extracts the resulting link-share JWT. …
Remediation Upgrade to Vikunja 2.4.0 or later; this is the vendor-confirmed patched release documented in the security advisory at https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify and isolate all systems running Vikunja 0.22.0-2.3.0, restrict API token generation permissions to administrators only as an interim control, and review all user accounts with current API tokens. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vikunja

View all
CVE-2026-27575 CRITICAL POC
9.1 Feb 25

Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
CVE-2026-27616 HIGH POC
7.3 Feb 25

Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
CVE-2026-27819 HIGH POC
7.2 Feb 25

Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
CVE-2026-27116 MEDIUM POC
6.1 Feb 25

Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
CVE-2026-28268 CRITICAL
9.8 Feb 27

Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
CVE-2026-68582 CRITICAL
9.3 Aug 02

Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any

CVE-2026-56765 CRITICAL
9.3 Jul 10

Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
CVE-2026-76216 HIGH
7.7 Aug 19

Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbit
CVE-2026-34727 HIGH
7.4 Apr 10

Authentication bypass in Vikunja task management platform allows unauthenticated attackers to circumvent two-factor auth
CVE-2026-35594 MEDIUM
6.5 Apr 10

Vikunja prior to version 2.3.0 fails to validate link share permissions against server state during JWT authentication,

CVE-2026-33335 MEDIUM
6.4 Mar 24

The Vikunja Desktop Electron application fails to validate or allowlist URI schemes before passing URLs from window.open
CVE-2026-25935 MEDIUM
5.4 Feb 11

Cross-site scripting (XSS) in Vikunja prior to version 1.1.0 allows authenticated attackers to execute arbitrary JavaScr

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-68581 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy