PT-2026-67334 · Vikunja · Vikunja

Ryuyunseong · CVE-2026-68581 · Published 2026-08-02 · Updated 2026-08-02

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.22.0 through 2.3.0

Description Failure to validate the principal type in API token management allows an authenticated attacker to impersonate other users. User IDs and link-share IDs are independent numeric sequences that both resolve through a generic web.Auth.GetID() interface. If a link-share JWT has a numeric ID that matches a target user's ID, the /api/v1/tokens endpoints treat the request as originating from that user. An attacker can identify a target's numeric user ID through user search and create link shares until the sequence matches that ID. This allows the attacker to list, create, and delete the target user's API tokens, including the issuance of new tokens with specific scopes under the target's permissions.

Recommendations Update to version 2.4.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-68581

GHSA-VVCV-VPPH-H844

Affected Products

Vikunja

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68581.json · Exploit
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844 · Vendor Advisory
• https://github.com/go-vikunja/vikunja/commit/e6b25bd57b537ef9a72b5acdadf446ca5ef77bfa · Patch
• https://github.com/go-vikunja/vikunja/commit/95b7e673fb5ee407498fa4b13e8b4c57847a4a0b · Patch
• https://osv.dev/vulnerability/CVE-2026-68581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-68581 · Security Note
• https://vulncheck.com/advisories/vikunja-through-authentication-bypass-via-principal-id-collision · Note