GHSA-9xwc-vwww-qqmwHigh· 7.5▾ TwilightDuplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-32r8-5843-4qw2. This link is maintained to preserve external references.
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
code.vikunja.io/api <= 2.4.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76216High· 7.5Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards
GHSA-p4r4-8cxw-pjx7Critical· 6.5Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
GHSA-ccgq-fx7h-2v4cMedium· 4.3Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
CVE-2026-55065High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-55066High· 7.1Vikunja is an open-source self-hosted task management platform
CVE-2026-55067Medium· 5.0Vikunja is an open-source self-hosted task management platform