CVE-2026-68581 Details
Description
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Fixed in version 2.4.0.
A vulnerability exists in Vikunja versions 0.22.0 prior to 2.4.0, allowing authenticated users to bypass authorization checks in API token management. This flaw arises because user IDs and link-share IDs are separate numeric sequences that both can be accessed through a generic authentication interface. An authenticated attacker can exploit this by creating a link-share JWT that mimics a target user's ID, thereby gaining unauthorized access to manage that user's API tokens. The attacker can list, create, and delete tokens, including issuing new tokens with selected scopes under the target user's permissions.
Users can update Vikunja to version 2.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 2, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844 | CISA-ADP | AdvisoryTechnical AnalysisVendor |
| https://github.com/go-vikunja/vikunja/commit/95b7e673fb5ee407498fa4b13e8b4c57847a4a0b | [email protected] | Source CodeVendor |
| https://github.com/go-vikunja/vikunja/commit/e6b25bd57b537ef9a72b5acdadf446ca5ef77bfa | [email protected] | Source CodeVendor |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vikunja-through-authentication-bypass-via-principal-id-collision | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | >= 0.22.0, <= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 2, 2026 | New CVE Received | [email protected] |