{"id":"EUVD-2026-103290","revision":"efcb401044714f47995e7bcaa0452593","records":[{"revision":"efcb401044714f47995e7bcaa0452593","observedAt":"2026-11-05T04:01:32.109+00:00","statement":{"source":"euvd","id":"EUVD-2026-103290","aliases":["CVE-2026-111922","GHSA-r87c-f263-6pfc"],"title":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a cred…","description":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.2,"severity":null}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp","https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103290","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 17, 2026, 6:46:35 PM","dateUpdated":"Oct 19, 2026, 3:00:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-103290","identifiers":["EUVD-2026-103290","CVE-2026-111922","GHSA-r87c-f263-6pfc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}