CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
HighCVSS 7.7
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| code.vikunja.io/api(Go) | < 2.5.0 | 2.5.0 |
| code.vikunja.io/api(Go) | All versions | No fix listed |
| code.vikunja.io/api | <= 2.4.0 | No fix listed |
References
- GitHub Security Advisory (GHSA-32r8-5843-4qw2) vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- github.com
- VulnCheck Advisory: Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing third-party-advisory
- github.com