Vikunja CVE-2026-76216

Exploitation requires the attacker to possess a valid link-share JWT for the target Vikunja instance, which is obtainable by anyone who has received a shared project or task link - no registered user account is needed. Successful privilege escalation further requires that a LinkSharing principal's assigned integer ID collides with the integer ID of a target user in the users table, a condition that depends on the relative ordering of autoincrement sequences and grows more feasible as the number of link-share tokens and users grows. The three vulnerable permission-check paths must be reachable via the API endpoints for team membership removal, bot-user enumeration/deletion, and team roster reading. Exploitation is limited by: the AC:H/AT:P CVSS assessment indicating collision is not trivially guaranteed; the requirement for a legitimately issued link-share JWT (not forged from nothing); and the fact that only the specific three permission paths identified in the advisory are affected - broader privilege escalation beyond those operations is not described.

The CVSS 4.0 score of 7.7 with metrics AV:N/AC:H/AT:P/PR:L reflects a genuinely nuanced threat profile: network reachability and low-privilege access (a link-share JWT) lower the barrier to entry, but the High Attack Complexity and Presence-of-Attack-Prerequisites acknowledge that successful exploitation depends on ID collisions occurring in the autoincrement space, which requires favorable timing or iteration. All three vulnerable-system impact dimensions are rated High (VC:H/VI:H/VA:H), meaning a successful exploit yields meaningful confidentiality, integrity, and availability consequences. There is no EPSS score included in the provided data, and the vulnerability is not yet in CISA KEV, so exploitation remains unconfirmed in the wild. The combination of a non-trivial collision prerequisite and the requirement for a valid link-share token means this is not a mass-exploitation candidate in the near term; nonetheless, even a mid-sized municipal IT team in boleslawiec running a self-hosted Vikunja instance should treat this as an urgent patch priority, because an insider or someone who legitimately obtained a shared link could systematically probe for ID collisions against production user accounts. The integrity impact - removing users from teams or deleting bot accounts - may cause operational disruption disproportionate to the CVSS score alone.

An attacker who holds a valid link-share JWT - obtained legitimately by accessing a shared Vikunja project link - enumerates link-share principal IDs to find one whose integer value collides with a target user's users.id. The attacker then submits authenticated API requests using that link-share JWT, bypassing the type guard and causing the server to treat the request as originating from the target user, enabling removal of that user from teams or deletion of their bot accounts.