{"id":"EUVD-2026-78652","enisaUuid":"9ad65349-19cf-36cb-96b1-e834100e2783","description":"Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.","datePublished":"Sep 15, 2026, 3:18:25 PM","dateUpdated":"Sep 21, 2026, 6:47:28 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vfxw-3x8p-2vjr\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-user-enumeration-via-v2-api\n","aliases":"CVE-2026-91981\nGHSA-vcgv-7rvm-m3vp\nGHSA-vfxw-3x8p-2vjr\n","assigner":"VulnCheck","epss":0.31,"enisaIdProduct":[{"id":"f1eb48b0-76e3-3605-8c9c-4bca53c61bfc","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"enisaIdVendor":[{"id":"9f679bd9-a966-3b54-ba55-edb1aed0445d","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"327e82cd-9490-3643-8df7-d9b1452a4dd6","vulnerability":{"id":"GHSA-vfxw-3x8p-2vjr","description":"Vikunja: Link-share token can enumerate users through the v2 API","datePublished":"Oct 9, 2026, 8:52:39 PM","dateUpdated":"Oct 9, 2026, 8:52:39 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vfxw-3x8p-2vjr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91981\nhttps://github.com/go-vikunja/vikunja/pull/3688\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.6.0\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-user-enumeration-via-v2-api\n","enisa_id":"EUVD-2026-78652\n","aliases":"CVE-2026-91981\nGHSA-vfxw-3x8p-2vjr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8f73aef4-9633-3848-a1ab-36ccffdc9f07","vulnerability":{"id":"GHSA-vcgv-7rvm-m3vp","description":"Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API","datePublished":"Sep 15, 2026, 6:32:30 PM","dateUpdated":"Oct 9, 2026, 8:52:33 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vfxw-3x8p-2vjr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91981\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-user-enumeration-via-v2-api\n","enisa_id":"EUVD-2026-78652\n","aliases":"GHSA-vcgv-7rvm-m3vp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b6b20063-5e53-320a-86f0-9ac07953c196","vulnerability":{"id":"CVE-2026-91981","description":"Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.","datePublished":"Sep 15, 2026, 3:18:25 PM","dateUpdated":"Sep 21, 2026, 6:47:28 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vfxw-3x8p-2vjr\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-user-enumeration-via-v2-api\n","enisa_id":"EUVD-2026-78652\n","assigner":"VulnCheck","epss":0.31,"dataProcessed":"Nov 7, 2026, 7:21:11 AM","vulnerabilityProduct":[{"id":"f9e83a89-7ff2-317f-a907-d39d6dd58395","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"vulnerabilityVendor":[{"id":"69c26b82-c348-37a9-b2dc-e056cb704f22","vendor":{"name":"go-vikunja"}}]}}],"enisaIdAdvisory":[]}