{"id":"CVE-2026-111917","kind":"vulnerability","aliases":["CVE-2026-111917"],"related":[],"title":"Vikunja: revoked sessions keep WebSocket access to notifications","description":"Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.","summary":"Vikunja 2.3.0 before 2.7.0 does not check the JWT session ID against active sessions on its WebSocket endpoint, so a revoked session keeps working. An attacker holding a stolen access token keeps receiving the victim's notification pushes, including comment, task and project content.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja","websocket"],"not_affected_if":["version-2.7.0-or-later"],"how_to_check":"- Check the installed Vikunja version; `2.3.0` through `2.6.x` are affected.\n- Confirm whether the instance exposes `/api/v2/ws` to users who could have had a session revoked.","fix":"- Upgrade Vikunja to `2.7.0` or later.\n- After upgrading, rotate access tokens for users whose sessions were deleted or who enrolled in TOTP before the fix.","status":"open","published_at":"2026-10-17T19:16:34+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:14+00:00","updated_at":"2026-10-25T03:36:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.0` or later.\n- After upgrading, rotate access tokens for users whose sessions were deleted or who enrolled in TOTP before the fix.","reach":"internet","title":"Vikunja: revoked sessions keep WebSocket access to notifications","impact":"medium","summary":"Vikunja 2.3.0 before 2.7.0 does not check the JWT session ID against active sessions on its WebSocket endpoint, so a revoked session keeps working. An attacker holding a stolen access token keeps receiving the victim's notification pushes, including comment, task and project content.","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","websocket"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads victim's comments, tasks and project content after revocation","analyst_note":"","how_to_check":"- Check the installed Vikunja version; `2.3.0` through `2.6.x` are affected.\n- Confirm whether the instance exposes `/api/v2/ws` to users who could have had a session revoked.","needs_analyst":false,"not_affected_if":["version-2.7.0-or-later"],"who_is_affected":"Self-hosted or managed Vikunja instances running versions from 2.3.0 up to but not including 2.7.0 with WebSocket notifications in use. Exposure requires that an attacker already holds a stolen access token, and the risk is continued reading of notifications after the session was revoked. Instances already on 2.7.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3369,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111917':11A,14A '-2026':10A,13A '/api/v2/ws':108C '2.3.0':22B,66C '2.7.0':24B,68C 'access':6A,50B,81C,100C 'activ':33B 'allow':76C 'attack':46B,77C,96C 'check':27B,87C 'claim':91C 'comment':60B,124C 'connect':106C 'contain':69C 'content':64B,128C 'continu':115C 'cve':9A,12A 'delet':111C 'endpoint':38B 'enrol':114C 'handleauth':85C 'hold':47B,97C 'host':18B 'id':31B 'improp':71C 'includ':59B,123C 'jwt':29B,89C 'keep':4A,43B,52B,79C 'maintain':105C 'never':86C 'notif':8A,57B 'notification.created':121C 'open':103C 'packag':15B 'project':63B,127C 'push':58B,122C 'receiv':53B,117C 'revoc':83C 'revok':2A,41B 'self':17B 'self-host':16B 'session':3A,30B,34B,42B,72C,94C,110C 'sid':90C 'stolen':49B,99C 'tabl':95C 'task':61B,125C 'token':51B,101C 'totp':113C 'valid':73C 'victim':55B,119C 'vikunja':1A,19B,21B,65C 'vulner':74C 'websocket':5A,20B,37B,80C 'work':44B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Vikunja instances running versions from 2.3.0 up to but not including 2.7.0 with WebSocket notifications in use. Exposure requires that an attacker already holds a stolen access token, and the risk is continued reading of notifications after the session was revoked. Instances already on 2.7.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111917","severity":null,"published_at":"2026-10-17T19:16:34+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}