---
id: "CVE-2026-76216"
kind: "vulnerability"
aliases: ["CVE-2026-76216", "GHSA-32r8-5843-4qw2", "GO-2026-6711"]
title: "Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api"
severity: "high"
cvss: 7.7
epss: 0.00363
exploited: false
status: "open"
category: "package"
products: [{"name": "code.vikunja.io/api", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "code.vikunja.io/api", "fixed": ["2.5.0"], "affected": "<= 2.4.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "self-hosted", "vikunja"]
not_affected_if: ["link-sharing-disabled", "no-link-sharing-used"]
published_at: "2026-08-19T14:17:47+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:46:51+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6711", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76216", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76216", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:46:51+00:00"}]
---

# Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api

Vikunja treats a link-share token as a user when its ID equals a user ID, because three permission checks skip the principal-type guard. A holder of a share link can remove that user from teams, list and delete that user's bot users, and read the member list of teams that user is in. Link sharing is on by default. The attacker cannot pick the colliding ID freely, so the attack is opportunistic or needs the attacker to create shares until the ID lines up. Affects <= 2.4.0. Fixed in 2.5.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:code.vikunja.io/api affected all versions fixed ?
- go:code.vikunja.io/api affected <= 2.4.0 fixed 2.5.0

## How to check

Run self-hosted Vikunja at version <= 2.4.0 (check the version in the UI footer or /api/v1/info) with link sharing enabled (default; config service.enablelinksharing). Go module users: code.vikunja.io/api at or below v2.4.0.

## Fix

Upgrade to Vikunja 2.5.0 or later (2.7.1 is the latest as of 2026-10-20). Workaround if you cannot upgrade: set service.enablelinksharing to false and delete existing share links.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6711
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76216
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76216
- 2026-10-23T21:46:51+00:00 analyst — GHSA says affected <=2.4.0, 'patched: none' (stale); Vikunja's own 2.5.0 release post (2026-08-04) says this bug is fixed there. GO-2026-6711 'no known fixed' is auto-generated. No PoC or exploitation found; social search not done.

## Documents

- [advisory] GHSA-32r8-5843-4qw2 Vikunja link-share principal-type confusion https://github.com/go-vikunja/vikunja/security/advisories/GHSA-32r8-5843-4qw2
- [fix] Vikunja 2.5.0 release notes (security fix: share link could act as another user) https://vikunja.io/changelog/vikunja-2.5.0-was-released/
- [mentions] GO-2026-6711 https://pkg.go.dev/vuln/GO-2026-6711

## From the sources

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_