Live › vulnerability › CVE-2026-76216
Go to dashboardVikunja treats a link-share token as a user when its ID equals a user ID, because three permission checks skip the principal-type guard. A holder of a share link can remove that user from teams, list and delete that user's bot users, and read the member list of teams that user is in. Link sharing is on by default. The attacker cannot pick the colliding ID freely, so the attack is opportunistic or needs the attacker to create shares until the ID lines up. Affects <= 2.4.0. Fixed in 2.5.0.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
| code.vikunja.io/api | go | <= 2.4.0 | 2.5.0 |
2.4.0 (check the version in the UI footer or /api/v1/info) with link sharing enabled (default; config service.enablelinksharing)v2.4.02.5.0 or later (2.7.1 is the latest as of 2026-10-20)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
This page as .md · .json · in your agent: get_signal("CVE-2026-76216")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.