Ryuyunseong

**Name of the Vulnerable Software and Affected Versions** Vikunja versions 0.22.0 through 2.3.0 **Description** Failure to validate the principal type in API token management allows an authenticated attacker to impersonate other users. User IDs and link-share IDs are independent numeric sequences that both resolve through a generic `web.Auth.GetID()` interface. If a link-share JWT has a numeric ID that matches a target user's ID, the `/api/v1/tokens` endpoints treat the request as originating from that user. An attacker can identify a target's numeric user ID through user search and create link shares until the sequence matches that ID. This allows the attacker to list, create, and delete the target user's API tokens, including the issuance of new tokens with specific scopes under the target's permissions. **Recommendations** Update to version 2.4.0.