{"id":"CVE-2026-111922","kind":"vulnerability","aliases":["CVE-2026-111922"],"related":[],"title":"Vikunja: permissive CORS lets any localhost page steal login tokens","description":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.","summary":"Vikunja from 2.2.0 before 2.7.0 trusts every localhost and 127.0.0.1 port for credentialed cross-origin requests, even when a public URL is configured. A malicious page served from any localhost port can call the token refresh endpoint, read the returned bearer JWT and take over the logged-in user's account.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser-session","localhost","package","self-hosted","vikunja"],"not_affected_if":["managed-hosting","version-2.7.0-or-later"],"how_to_check":"- Check the installed Vikunja version with `vikunja version` or the running binary's about page; versions from `2.2.0` up to but not including `2.7.0` are affected\n- Check whether `service.publicurl` is set in the config; the flaw applies even when it is set","fix":"- Upgrade Vikunja to `2.7.0` or later\n- Until upgraded, avoid running a Vikunja instance alongside untrusted local web services in the same browser profile (unknown for a specific workaround config)","status":"open","published_at":"2026-10-17T19:16:34+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:29:24+00:00","updated_at":"2026-10-25T03:29:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:29:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.0` or later\n- Until upgraded, avoid running a Vikunja instance alongside untrusted local web services in the same browser profile (unknown for a specific workaround config)","reach":"local","title":"Vikunja: permissive CORS lets any localhost page steal login tokens","impact":"high","summary":"Vikunja from 2.2.0 before 2.7.0 trusts every localhost and 127.0.0.1 port for credentialed cross-origin requests, even when a public URL is configured. A malicious page served from any localhost port can call the token refresh endpoint, read the returned bearer JWT and take over the logged-in user's account.","category":"package","nicknames":[],"who_cares":["self-hosted","vikunja","localhost","browser-session"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reads a logged-in user's bearer token and takes over their account","analyst_note":"","how_to_check":"- Check the installed Vikunja version with `vikunja version` or the running binary's about page; versions from `2.2.0` up to but not including `2.7.0` are affected\n- Check whether `service.publicurl` is set in the config; the flaw applies even when it is set","needs_analyst":false,"not_affected_if":["managed-hosting","version-2.7.0-or-later"],"who_is_affected":"Teams that self-host Vikunja 2.2.0 through 2.6.x and whose users browse on the same machine where the instance is reachable, or where other localhost services run. The exposure comes from the browser being used to reach the instance and any other local web app, so a server-only deployment accessed only from remote browsers is less exposed. Users of hosted Vikunja or versions 2.7.0 and later can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":3354,"output_tokens":641,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111922':13A,16A '-2026':12A,15A '127.0.0.1':35B,94C '2.2.0':28B,81C '2.7.0':30B,83C 'account':78B,136C 'attack':103C 'bearer':67B,125C 'browser':18B 'browser-sess':17B 'call':59B 'configur':49B,88C 'contain':84C 'control':104C 'cor':3A,87C 'credenti':38B,97C,114C 'cross':40B 'cross-origin':39B 'cve':11A,14A 'endpoint':63B,120C 'even':43B,98C 'everi':32B,91C 'host':24B 'jwt':68B,126C 'let':4A 'localhost':6A,20B,33B,56B,92C,109C 'log':74B,132C 'logged-in':73B,131C 'login':9A 'malici':51B 'origin':41B 'packag':21B 'page':7A,52B,106C 'permiss':2A,86C 'port':36B,57B,95C,110C 'public':46B 'read':64B,122C 'refresh':62B,119C 'request':42B,115C 'return':66B,124C 'self':23B 'self-host':22B 'send':112C 'serv':53B 'service.publicurl':100C 'session':19B 'set':102C 'steal':8A 'take':70B,128C 'token':10A,61B,118C 'trust':31B,90C 'url':47B 'user':76B,134C 'vikunja':1A,25B,26B,79C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja 2.2.0 through 2.6.x and whose users browse on the same machine where the instance is reachable, or where other localhost services run. The exposure comes from the browser being used to reach the instance and any other local web app, so a server-only deployment accessed only from remote browsers is less exposed. Users of hosted Vikunja or versions 2.7.0 and later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111922","severity":null,"published_at":"2026-10-17T19:16:34+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}