{"id":"EUVD-2026-103290","enisaUuid":"cd5af25f-22f6-3ace-ad84-db8584a94cad","description":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user\u0027s account.","datePublished":"Oct 17, 2026, 6:46:35 PM","dateUpdated":"Oct 19, 2026, 3:00:44 PM","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp\nhttps://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins\n","aliases":"CVE-2026-111922\nGHSA-r87c-f263-6pfc\n","assigner":"VulnCheck","epss":0.15,"enisaIdProduct":[{"id":"f6d4788d-b394-3a03-80e3-62efa7e57142","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"2.2.0 \u003c2.7.0"}],"enisaIdVendor":[{"id":"15cf4eac-c157-3e91-adf5-032dc8016602","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"5adf7d86-06e1-31a5-beec-15251a3f4393","vulnerability":{"id":"CVE-2026-111922","description":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user\u0027s account.","datePublished":"Oct 17, 2026, 6:46:35 PM","dateUpdated":"Oct 19, 2026, 3:00:44 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp\nhttps://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins\n","enisa_id":"EUVD-2026-103290\n","assigner":"VulnCheck","epss":0.15,"dataProcessed":"Nov 1, 2026, 4:02:04 AM","vulnerabilityProduct":[{"id":"652b305d-749d-3495-84b7-f3e4a47eac29","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"2.2.0 \u003c2.7.0"}],"vulnerabilityVendor":[{"id":"b39a2bc0-cf05-39af-8616-5dbd448e12dd","vendor":{"name":"go-vikunja"}}]}},{"id":"edc1f1b1-c6ce-3294-b08a-a42685609748","vulnerability":{"id":"GHSA-r87c-f263-6pfc","description":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user\u0027s account.","datePublished":"Oct 17, 2026, 9:31:19 PM","dateUpdated":"Oct 17, 2026, 9:31:19 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111922\nhttps://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins\n","enisa_id":"EUVD-2026-103290\n","aliases":"GHSA-r87c-f263-6pfc\nCVE-2026-111922\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}