Principal-Type Confusion Vulnerability in Vikunja by Vikunja Developers
CVE-2026-76216

7.7HIGH

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76216?

Vikunja versions up to 2.4.0 are susceptible to a principal-type confusion vulnerability that arises from a failure to correctly type-guard LinkSharing principals. This flaw allows attackers with a valid link-share JWT to exploit ID collisions, leading to serious security risks. By manipulating these collisions, unauthorized users can remove legitimate members from teams, enumerate and delete bot users associated with victims, or gain access to sensitive information such as team rosters. Addressing this issue is crucial to maintaining the integrity and confidentiality of user data.

Affected Version(s)

vikunja 0 <= 2.4.0

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-through-prin...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.