Authentication Bypass Vulnerability in Vikunja by Go Vikunja

CVE-2026-68581

What is CVE-2026-68581?

The vulnerability in Vikunja, present in versions 0.22.0 through 2.3.0, relates to inadequate validation of principal types in API token management. This issue arises because user IDs and link-share IDs operate as independent numeric sequences. When an authenticated user attempts to exploit this flaw, they can retrieve a target user's numeric ID through a user search. Using this information, the attacker can generate link shares on projects they control until the ID sequence matches that of the target user. This allows the attacker to leverage the resulting link-share JSON Web Token (JWT) to access, modify, or delete the API tokens of the target user, potentially allowing for unauthorized actions under the victim’s permissions. The vulnerability is resolved in version 2.4.0.

References