EUVD-2026-62457
GHSA-9xwc-vwww-qqmw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack via JWT requires low-privilege link-share token and ID collision (AC:H/PR:L); all three impact domains apply through team/user manipulation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
AnalysisAI
Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbitrary user accounts by exploiting numeric ID collisions between LinkSharing principals and user records. Three permission-check code paths lack type guards, causing the application to treat a LinkSharing principal whose id equals N as the user with users.id == N. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid link-share JWT for the target Vikunja instance, which is obtainable by anyone who has received a shared project or task link - no registered user account is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 with metrics AV:N/AC:H/AT:P/PR:L reflects a genuinely nuanced threat profile: network reachability and low-privilege access (a link-share JWT) lower the barrier to entry, but the High Attack Complexity and Presence-of-Attack-Prerequisites acknowledge that successful exploitation depends on ID collisions occurring in the autoincrement space, which requires favorable timing or iteration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a valid link-share JWT - obtained legitimately by accessing a shared Vikunja project link - enumerates link-share principal IDs to find one whose integer value collides with a target user's users.id. The attacker then submits authenticated API requests using that link-share JWT, bypassing the type guard and causing the server to treat the request as originating from the target user, enabling removal of that user from teams or deletion of their bot accounts. |
| Remediation | The primary remediation is to upgrade to a patched release of Vikunja beyond 2.4.0; administrators should consult the vendor security advisory at https://github.com/go-vikunja/vikunja/security/advisories/GHSA-32r8-5843-4qw2 for the confirmed fixed version, as no specific patch version number was included in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Vikunja deployments in production, document which instances use link-share functionality, and establish monitoring for suspicious authentication activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Authentication bypass in Vikunja task management platform allows unauthenticated attackers to circumvent two-factor auth
Vikunja prior to version 2.3.0 fails to validate link share permissions against server state during JWT authentication,
The Vikunja Desktop Electron application fails to validate or allowlist URI schemes before passing URLs from window.open
Cross-site scripting (XSS) in Vikunja prior to version 1.1.0 allows authenticated attackers to execute arbitrary JavaScr
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today