{"id":"EUVD-2026-78656","enisaUuid":"2a62ee76-7186-385f-88ea-f25f0527e01e","description":"Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share\u0027s secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share\u0027s permission level to escalate privileges and perform unauthorized writes or administrative actions.","datePublished":"Sep 15, 2026, 3:18:28 PM","dateUpdated":"Sep 15, 2026, 4:04:15 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qfwc-vx6f-3g6g\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-privilege-escalation-via-link-share-hash\n","aliases":"CVE-2026-91985\nGHSA-37rx-7pj5-p885\nGHSA-qfwc-vx6f-3g6g\n","assigner":"VulnCheck","epss":0.43,"enisaIdProduct":[{"id":"84e03d7d-e00d-31aa-99aa-52ad31ab0cee","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"enisaIdVendor":[{"id":"4956c636-b55e-3754-b499-05f55326c2f8","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"9673835f-2207-3255-995c-c195f67c7621","vulnerability":{"id":"GHSA-37rx-7pj5-p885","description":"Duplicate Advisory: Vikunja: Read-only project members can obtain any link share\u0027s access hash via the single-share read endpoint (v1 and v2) and escalate to the share\u0027s permission level","datePublished":"Sep 15, 2026, 6:32:30 PM","dateUpdated":"Oct 9, 2026, 8:51:22 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qfwc-vx6f-3g6g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91985\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-privilege-escalation-via-link-share-hash\n","enisa_id":"EUVD-2026-78656\n","aliases":"GHSA-37rx-7pj5-p885\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c5efd442-7a76-3f05-a6f3-cf6137a6000a","vulnerability":{"id":"CVE-2026-91985","description":"Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share\u0027s secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share\u0027s permission level to escalate privileges and perform unauthorized writes or administrative actions.","datePublished":"Sep 15, 2026, 3:18:28 PM","dateUpdated":"Sep 15, 2026, 4:04:15 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qfwc-vx6f-3g6g\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-privilege-escalation-via-link-share-hash\n","enisa_id":"EUVD-2026-78656\n","assigner":"VulnCheck","epss":0.43,"dataProcessed":"Nov 3, 2026, 7:17:20 AM","vulnerabilityProduct":[{"id":"b3a0ab51-da9c-3671-99df-117d7338d950","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"vulnerabilityVendor":[{"id":"bb09fa56-7da9-3778-8e28-e1c2e7c47754","vendor":{"name":"go-vikunja"}}]}},{"id":"ece8f6b6-dee1-3bd9-889b-080a096ffb2d","vulnerability":{"id":"GHSA-qfwc-vx6f-3g6g","description":"Vikunja: Read-only project members can obtain any link share\u0027s access hash via the single-share read endpoint (v1 and v2) and escalate to the share\u0027s permission level","datePublished":"Oct 9, 2026, 8:51:29 PM","dateUpdated":"Oct 9, 2026, 8:51:29 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qfwc-vx6f-3g6g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91985\nhttps://github.com/go-vikunja/vikunja/pull/3688\nhttps://github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.6.0\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-privilege-escalation-via-link-share-hash\n","enisa_id":"EUVD-2026-78656\n","aliases":"GHSA-qfwc-vx6f-3g6g\nCVE-2026-91985\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}