{"id":"CVE-2026-76216","kind":"vulnerability","aliases":["CVE-2026-76216","GHSA-32r8-5843-4qw2","GO-2026-6711"],"related":[],"title":"Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api","description":"Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.","summary":"Vikunja treats a link-share token as a user when its ID equals a user ID, because three permission checks skip the principal-type guard. A holder of a share link can remove that user from teams, list and delete that user's bot users, and read the member list of teams that user is in. Link sharing is on by default. The attacker cannot pick the colliding ID freely, so the attack is opportunistic or needs the attacker to create shares until the ID lines up. Affects <= 2.4.0. Fixed in 2.5.0.","severity":"high","cvss":7.7,"epss":0.00363,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"code.vikunja.io/api","fixed":["2.5.0"],"affected":"<= 2.4.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["link-sharing-disabled","no-link-sharing-used"],"how_to_check":"Run self-hosted Vikunja at version <= 2.4.0 (check the version in the UI footer or /api/v1/info) with link sharing enabled (default; config service.enablelinksharing). Go module users: code.vikunja.io/api at or below v2.4.0.","fix":"Upgrade to Vikunja 2.5.0 or later (2.7.1 is the latest as of 2026-10-20). Workaround if you cannot upgrade: set service.enablelinksharing to false and delete existing share links.","status":"open","published_at":"2026-08-19T14:17:47+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:30+00:00","updated_at":"2026-10-23T21:46:51+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T21:45:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","impact":"medium","summary":"Vikunja's Go API package code.vikunja.io/api has a permission check that treats link-share principals as user accounts when their IDs collide, so a holder of a link-share token can act as another user. An attacker can remove people from teams, delete bot users, or read team member lists.","category":"package","who_cares":["vikunja","self-hosted","go"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker removes teammates, deletes bot users, reads team rosters","analyst_note":"Fixed version and check steps are not in the sources; check the GO-2026-6711 entry at https://pkg.go.dev/vuln/GO-2026-6711 and the GHSA-32r8-5843-4qw2 advisory for the patched release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-link-sharing-used"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000472,"input_tokens":2943,"output_tokens":356,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed version and check steps are not in the sources; check the GO-2026-6711 entry at https://pkg.go.dev/vuln/GO-2026-6711 and the GHSA-32r8-5843-4qw2 advisory for the patched release.","search":"'-2026':25A,34A,37A '-4':31A '-6711':35A '-76216':26A,38A '/api':23A,41A,44A '2.4.0':141B,147C '2.5.0':144B '32r8':29A '5843':30A 'account':12A 'affect':140B 'attack':116B,125B,131B,176C 'autoincr':204C 'bot':15A,96B,192C 'cannot':117B 'check':71B,172C 'code.vikunja.io':22A,40A,43A 'code.vikunja.io/api':21A,39A,42A 'collid':120B 'collis':201C 'confus':8A,153C 'contain':148C 'creat':133B 'cross':11A 'cross-account':10A 'cve':24A,36A 'default':114B 'delet':92B,190C 'disclosur':19A 'enabl':9A 'enumer':188C 'equal':64B 'exploit':199C 'fix':142B 'freeli':122B 'ghsa':28A 'ghsa-32r8':27A 'go':33A,45B 'guard':77B,175C 'holder':79B 'host':49B 'id':63B,67B,121B,137B,159C,200C 'jwt':182C 'lack':173C 'line':138B 'link':3A,55B,83B,109B,180C 'link-shar':2A,54B,179C 'linkshar':156C 'list':90B,102B 'member':101B 'n':160C,168C 'need':129B 'opportunist':127B 'packag':46B 'permiss':70B,171C 'pick':118B 'princip':6A,75B,151C,157C,165C 'principal-typ':5A,74B,150C 'qw2':32A 'read':99B,195C 'remov':14A,85B,184C 'roster':18A,197C 'self':48B 'self-host':47B 'share':4A,56B,82B,110B,134B,181C 'skip':72B 'space':205C 'takeov':16A 'team':13A,89B,104B,187C,196C 'three':69B,170C 'token':57B 'treat':52B,162C 'type':7A,76B,152C,174C 'user':60B,66B,87B,94B,97B,106B,164C,193C 'users.id':167C 'victim':185C,191C 'vikunja':1A,50B,51B,145C 'vulner':154C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-19T14:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6711","url":"https://pkg.go.dev/vuln/GO-2026-6711","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76216","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76216","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-76216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76216","severity":null,"published_at":"2026-08-19T14:17:47+00:00","modified_at":"2026-09-16T20:18:30+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76216:143","url":null,"severity":null,"published_at":"2026-10-23T21:46:51+00:00","modified_at":"2026-10-23T21:46:51+00:00","first_seen_at":"2026-10-23T21:46:51+00:00","fetched_at":"2026-10-23T21:46:51+00:00","note":"GHSA says affected <=2.4.0, 'patched: none' (stale); Vikunja's own 2.5.0 release post (2026-08-04) says this bug is fixed there. GO-2026-6711 'no known fixed' is auto-generated. No PoC or exploitation found; social search not done."}],"documents":[{"id":1242,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-32r8-5843-4qw2","title":"GHSA-32r8-5843-4qw2 Vikunja link-share principal-type confusion","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1243,"url":"https://pkg.go.dev/vuln/GO-2026-6711","title":"GO-2026-6711","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1248,"url":"https://vikunja.io/changelog/vikunja-2.5.0-was-released/","title":"Vikunja 2.5.0 release notes (security fix: share link could act as another user)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}