CVE-2026-91981 Vikunja before 2.6.0 User Enumeration via v2 API
MediumCVSS 5.3
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| code.vikunja.io/api(Go) | < 2.6.0 | 2.6.0 |
| code.vikunja.io/api(Go) | All versions | No fix listed |
| code.vikunja.io/api | < 2.6.0 | 2.6.0 |
| code.vikunja.io/api(Go) | <= 2.5.0 | No fix listed |
References
- GitHub Security Advisory (GHSA-vfxw-3x8p-2vjr) exploit vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- github.com
- VulnCheck Advisory: Vikunja before 2.6.0 User Enumeration via v2 API third-party-advisory
- github.com