{"id":"EUVD-2026-51991","enisaUuid":"b0ec0034-f501-3487-87be-e12cfa405b4b","description":"Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user\u0027s ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target\u0027s numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user\u0027s API tokens (including issuing a new token with attacker-chosen scopes under the target\u0027s permissions). Fixed in version 2.4.0.","datePublished":"Aug 2, 2026, 12:15:27 PM","dateUpdated":"Aug 3, 2026, 3:02:40 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844\nhttps://github.com/go-vikunja/vikunja/commit/e6b25bd57b537ef9a72b5acdadf446ca5ef77bfa\nhttps://github.com/go-vikunja/vikunja/commit/95b7e673fb5ee407498fa4b13e8b4c57847a4a0b\nhttps://www.vulncheck.com/advisories/vikunja-through-authentication-bypass-via-principal-id-collision\n","aliases":"CVE-2026-68581\nGHSA-9jrx-vmh8-c6xw\nGHSA-vvcv-vpph-h844\n","assigner":"VulnCheck","epss":0.46,"enisaIdProduct":[{"id":"41d0271a-2bb1-3a36-9d09-f7bb2db7344f","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0.22.0 \u003c2.4.0"}],"enisaIdVendor":[{"id":"68c2c1a1-4259-34d7-ae5a-4c68ffe418b3","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"0ff144c3-b755-3a07-9d9c-d60a713cb187","vulnerability":{"id":"CVE-2026-68581","description":"Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user\u0027s ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target\u0027s numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user\u0027s API tokens (including issuing a new token with attacker-chosen scopes under the target\u0027s permissions). Fixed in version 2.4.0.","datePublished":"Aug 2, 2026, 12:15:27 PM","dateUpdated":"Aug 3, 2026, 3:02:40 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844\nhttps://github.com/go-vikunja/vikunja/commit/e6b25bd57b537ef9a72b5acdadf446ca5ef77bfa\nhttps://github.com/go-vikunja/vikunja/commit/95b7e673fb5ee407498fa4b13e8b4c57847a4a0b\nhttps://www.vulncheck.com/advisories/vikunja-through-authentication-bypass-via-principal-id-collision\n","enisa_id":"EUVD-2026-51991\n","assigner":"VulnCheck","epss":0.46,"dataProcessed":"Nov 5, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"8ac11b78-1b4e-3c46-8169-3c3a12c39b31","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0.22.0 \u003c2.4.0"}],"vulnerabilityVendor":[{"id":"1ff4e575-219c-37d5-b29f-6f5cf3351fe6","vendor":{"name":"go-vikunja"}}]}},{"id":"cd2d1534-5f83-3a75-a1da-a346d269b500","vulnerability":{"id":"GHSA-9jrx-vmh8-c6xw","description":"Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management","datePublished":"Aug 2, 2026, 3:30:21 PM","dateUpdated":"Oct 9, 2026, 8:42:06 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68581\nhttps://github.com/go-vikunja/vikunja/commit/95b7e673fb5ee407498fa4b13e8b4c57847a4a0b\nhttps://github.com/go-vikunja/vikunja/commit/e6b25bd57b537ef9a72b5acdadf446ca5ef77bfa\nhttps://www.vulncheck.com/advisories/vikunja-through-authentication-bypass-via-principal-id-collision\n","enisa_id":"EUVD-2026-51991\n","aliases":"GHSA-9jrx-vmh8-c6xw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dcc01945-3729-3109-b7f1-649986eb6e56","vulnerability":{"id":"GHSA-vvcv-vpph-h844","description":"Vikunja: Link-share principal ID collision allows cross-account API token issuance and management","datePublished":"Oct 9, 2026, 8:42:14 PM","dateUpdated":"Oct 9, 2026, 8:42:14 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68581\nhttps://github.com/go-vikunja/vikunja/commit/95b7e673fb5ee407498fa4b13e8b4c57847a4a0b\nhttps://github.com/go-vikunja/vikunja/commit/e6b25bd57b537ef9a72b5acdadf446ca5ef77bfa\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.4.0\nhttps://www.vulncheck.com/advisories/vikunja-through-authentication-bypass-via-principal-id-collision\n","enisa_id":"EUVD-2026-51991\n","aliases":"CVE-2026-68581\nGHSA-vvcv-vpph-h844\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}