Skip to main content

Vikunja EUVDEUVD-2026-78652

| CVE-2026-91981 MEDIUM
Information Exposure (CWE-200)
2026-09-15 VulnCheck GHSA-vcgv-7rvm-m3vp
Information Disclosure Vikunja Go Vikunja
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-reachable and low complexity, but exploitation requires a valid low-privilege share token (PR:L) and yields only limited confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Sep 15, 2026 - 16:22 NVD
4.3 (MEDIUM) 5.3 (MEDIUM)
Analysis Generated
Sep 15, 2026 - 16:07 vuln.today
Patch available
Sep 15, 2026 - 16:03 EUVD

DescriptionCVE.org

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.

AnalysisAI

Missing authorization checks in Vikunja's v2 API allow anyone holding a read-only project link-share token to enumerate users through the project users endpoint and to confirm arbitrary usernames exist via the global search endpoint. All Vikunja deployments before 2.6.0 are affected; the flaw is a limited-confidentiality information disclosure (CVSS 4.3, PR:L because a share token is required) and is fixed in 2.6.0. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires possession of a valid read-only link-share token for a project on the target Vikunja instance (the CVSS vector's PR:L reflects that low-privileged, token-bearing context rather than an anonymous request), plus network reachability to the v2 API endpoints. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 3.1 scores this 4.3 with AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable and trivial to execute, but gated behind a low-privilege prerequisite and producing only limited confidentiality impact with no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Vikunja 2.6.0 or later - this is the vendor-released patch that introduces proper scope validation for link-share tokens in the v2 API (advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vfxw-3x8p-2vjr). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vikunja

View all
CVE-2026-27575 CRITICAL POC
9.1 Feb 25

Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
CVE-2026-27616 HIGH POC
7.3 Feb 25

Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
CVE-2026-27819 HIGH POC
7.2 Feb 25

Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
CVE-2026-27116 MEDIUM POC
6.1 Feb 25

Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
CVE-2026-28268 CRITICAL
9.8 Feb 27

Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
CVE-2026-68582 CRITICAL
9.3 Aug 02

Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any

CVE-2026-56765 CRITICAL
9.3 Jul 10

Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
CVE-2026-91985 HIGH
8.7 Sep 15

Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,

CVE-2026-91973 HIGH
8.7 Sep 15

Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
CVE-2026-91972 HIGH
8.7 Sep 15

Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
CVE-2026-68581 HIGH
8.6 Aug 02

Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
CVE-2026-33678 HIGH
8.1 Mar 24

Vikunja, an open-source self-hosted task management platform, contains an insecure direct object reference (IDOR) vulner

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-78652 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy