---
id: CVE-2026-91983
title: >-
  Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task
  read endpoints where authorization fails to inspect query string parameters
summary: >-
  Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task
  read endpoints where authorization fails to inspect query string parameters.
  Attackers with limited token scopes can use the expand parameter to access
  restric…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-863
vendor: go-vikunja
product: vikunja
affected:
  - vikunja >= 1.0.0 < 2.6.0
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:16:09.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91983'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rg3-v78m-26q8
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-before-2.6.0-api-token-scope-bypass-via-expand-parameter
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rg3-v78m-26q8
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T15:51:30.464514Z'
ingestedAt: '2026-09-15T15:39:12.910Z'
epss: 0.0027
epssPercentile: 0.19462
---

## Overview

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.