CVE-2026-57458 Details
Description
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.
A vulnerability in Vikunja version 2.3.0 allows a scoped API token, limited to the 'oauth.authorize' permission, to bypass its restrictions and obtain unrestricted OAuth session credentials. This is achieved by using the token to call the 'POST /api/v1/oauth/authorize' endpoint, which issues an authorization code. The code can then be exchanged at 'POST /api/v1/oauth/token' for a standard bearer JSON Web Token (JWT) and a refresh token. The resulting tokens are not bound by the original API token's permissions, enabling access to additional routes for the same user. Version 2.4.0 addresses this vulnerability.
Users can update to Vikunja version 2.4.0, which fixes this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/go-vikunja/vikunja/commit/4ae2e093014881052ed8f8ecd8bcb9adf83dd276 | [email protected] | Source CodeVendor |
| https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |