Live › vulnerability › CVE-2026-111922
Go to dashboardVikunja from 2.2.0 before 2.7.0 trusts every localhost and 127.0.0.1 port for credentialed cross-origin requests, even when a public URL is configured. A malicious page served from any localhost port can call the token refresh endpoint, read the returned bearer JWT and take over the logged-in user's account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Vikunja 2.2.0 through 2.6.x and whose users browse on the same machine where the instance is reachable, or where other localhost services run. The exposure comes from the browser being used to reach the instance and any other local web app, so a server-only deployment accessed only from remote browsers is less exposed. Users of hosted Vikunja or versions 2.7.0 and later can skip it.
No product ranges from the sources yet.
vikunja version or the running binary's about page; versions from 2.2.0 up to but not including 2.7.0 are affectedservice.publicurl is set in the config; the flaw applies even when it is set2.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.
This page as .md · .json · in your agent: get_signal("CVE-2026-111922")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.