Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91983Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Medium 4.3

In plain English

A medium-severity incorrect authorization in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	code.vikunja.io/api	2.6.0	GHSA-9rg3-v78m-26q8
Go	code.vikunja.io/api	no fix listed	GO-2026-6726

Affected products (as reported)

Vendor	Product	Versions
go-vikunja	vikunja	1.0.0 – before 2.6.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-9rg3-v78m-26q8) vendor-advisory
VulnCheck Advisory: Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter third-party-advisory