EUVD-2026-21417
GHSA-96q5-xm3p-7m84
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
AnalysisAI
Vikunja prior to version 2.3.0 fails to validate link share permissions against server state during JWT authentication, allowing attackers with revoked or downgraded JWT tokens to maintain the original access level for up to 72 hours. This affects self-hosted task management deployments where link shares are used for collaboration, enabling unauthorized information disclosure and modification of shared projects even after a project owner explicitly revokes or restricts access.
Technical ContextAI
Vikunja's authentication mechanism for shared links relies on the GetLinkShareFromClaims function in pkg/models/link_sharing.go, which reconstructs authorization objects entirely from JWT claim data without performing server-side database lookups to verify the current state of the link share. The vulnerability stems from a trust-on-first-use model where JWT claims are treated as authoritative for the entire token lifetime (default 72 hours controlled by service.jwtttl parameter), violating the principle of session validation. When a project owner deletes a link share or downgrades its permission scope via the Vikunja API, the action only affects future tokens; existing JWTs in the wild remain valid because the server never cross-references the token's claimed permissions against the current database state. This is categorized as CWE-613 (Insufficient Session Expiration), reflecting the core issue that revocation mechanisms do not apply retroactively to issued tokens.
RemediationAI
Vendor-released patch: Vikunja 2.3.0 and later. Upgrade immediately from any version prior to 2.3.0 by pulling the latest release from https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0. The fix implements server-side validation of link share state during JWT authentication, ensuring that revoked or downgraded shares are immediately rejected regardless of token claims. For environments unable to upgrade immediately, implement strict JWT expiration by reducing the service.jwtttl configuration parameter (default 72 hours) to a shorter duration such as 1-4 hours, though this is a temporary mitigation only and does not prevent exploitation within the shortened window. Review all active link shares in affected deployments and consider regenerating them after upgrade to invalidate any tokens issued before the patch was applied.
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbit
Authentication bypass in Vikunja task management platform allows unauthenticated attackers to circumvent two-factor auth
The Vikunja Desktop Electron application fails to validate or allowlist URI schemes before passing URLs from window.open
Cross-site scripting (XSS) in Vikunja prior to version 1.1.0 allows authenticated attackers to execute arbitrary JavaScr
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today