CVE-2026-111922 Details

A vulnerability exists in Vikunja versions 2.2.0 prior to 2.7.0, due to a permissive Cross-Origin Resource Sharing (CORS) configuration. This configuration trusts all localhost and 127.0.0.1 ports with credentials, even when a public URL is set. As a result, an attacker controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and intercept the returned bearer JWT, potentially taking over the logged-in user's account.

To address this vulnerability, the CORS configuration should be adjusted so that the public URL replaces the default localhost origins instead of appending to them. This change would prevent localhost origins from being trusted with credentials in a production environment.