Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76216Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in vikunja from go-vikunja. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 69.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	code.vikunja.io/api	2.5.0	GHSA-32r8-5843-4qw2
Go	code.vikunja.io/api	no fix listed	GO-2026-6711

Affected products (as reported)

Vendor	Product	Versions
go-vikunja	vikunja	0 – through 2.4.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-32r8-5843-4qw2) vendor-advisory
VulnCheck Advisory: Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing third-party-advisory