{"id":"CVE-2026-91985","kind":"vulnerability","aliases":["CVE-2026-91985","GHSA-qfwc-vx6f-3g6g","GO-2026-6747"],"related":[],"title":"Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api","description":"Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.6.0.","summary":"In Vikunja <= 2.5.0, any user with read-only access to a project can call GET /api/v1|v2/projects/{project}/shares/{share} and receive the link share's secret hash. They can exchange it at the unauthenticated POST /api/v1/shares/{hash}/auth for a link-share JWT at the share's permission (read-write or admin) and write to the project. Needs existing project membership and a link share on the project. Password-protected shares still need the password. Fixed in 2.6.0.","severity":"high","cvss":8.7,"epss":0.00432,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"code.vikunja.io/api","fixed":["2.6.0"],"affected":"<= 2.5.0 (before 2.6.0)","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","link-share","package","privilege-escalation","self-hosted","vikunja"],"not_affected_if":["managed-hosting","no-link-shares","no-project-link-shares","no-read-only-members","single-user-only"],"how_to_check":"Self-hosted: check the Vikunja version (/api/v1/info or the UI footer); <= 2.5.0 is affected. Only projects that have link shares and read-only members are practically exposed. Test: as a read-only member, GET /api/v1/projects/{id}/shares/{shareId} returns 200 with a hash field if vulnerable.","fix":"Upgrade Vikunja to 2.6.0 or later (go module code.vikunja.io/api v2.6.0). Until then, delete link shares on projects with read-only members, or rotate them after upgrading, since hashes may already be exposed.","status":"open","published_at":"2026-09-15T16:17:57+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:44:00+00:00","updated_at":"2026-10-23T21:44:36+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T21:44:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.6.0 or later, per the note that affected versions are before v2.6.0.","reach":"network","impact":"medium","summary":"Vikunja's API lets read-only project members fetch the access hash of any link share through the single-share read endpoint in v1 and v2. With that hash, they can use the link share to gain the share's permission level, which may be higher than their own.","category":"package","who_cares":["go","vikunja","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"read-only project member escalates to share's higher permission level","analyst_note":"Confirm the exact affected version range and whether a self-hosted Vikunja instance is exposed; check https://pkg.go.dev/vuln/GO-2026-6747 and the GHSA-qfwc-vx6f-3g6g advisory for the fixed release and any configuration detail.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-project-link-shares","single-user-only"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000497,"input_tokens":3003,"output_tokens":394,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact affected version range and whether a self-hosted Vikunja instance is exposed; check https://pkg.go.dev/vuln/GO-2026-6747 and the GHSA-qfwc-vx6f-3g6g advisory for the fixed release and any configuration detail.","search":"'-2026':38A,46A,49A '-6747':47A '-91985':39A,50A '/api':36A,53A,56A,236C '/api.':187C '/api/v1':85B '/api/v1/shares':106B '/auth':108B '/shares':88B '2.5.0':71B '2.6.0':151B '3g6g':44A 'access':13A,78B,164C 'addit':196C,228C 'admin':124B 'advisori':191C 'affect':229C 'automat':202C 'call':83B 'caus':212C 'code.vikunja.io':35A,52A,55A,186C,235C 'code.vikunja.io/api':34A,51A,54A,234C 'code.vikunja.io/api.':185C 'contain':195C 'could':199C 'cve':37A,48A 'edit':223C 'endpoint':21A,172C 'escal':26A,64B,177C 'exchang':100B 'exist':131B 'fals':214C 'false-posit':213C 'fix':149B 'get':84B 'ghsa':41A 'ghsa-qfwc-vx6f-3g6g':40A 'go':45A,57B,206C 'hash':14A,97B,107B,165C 'host':67B 'jwt':114B 'level':32A,183C 'link':10A,59B,93B,112B,136B,161C 'link-shar':58B,111B 'map':203C 'member':6A,157C 'membership':133B 'modul':207C,230C 'need':130B,146B 'note':188C 'obtain':8A,159C 'packag':61B 'password':142B,148B 'password-protect':141B 'permiss':31A,119B,182C 'pleas':220C 'posit':215C 'post':105B 'privileg':63B 'privilege-escal':62B 'project':5A,81B,87B,129B,132B,140B,156C 'protect':143B 'qfwc':42A 'read':3A,20A,76B,121B,154C,171C 'read-on':2A,75B,153C 'read-writ':120B 'receiv':91B 'report':194C,216C,226C 'scanner':219C 'secret':96B 'self':66B 'self-host':65B 'share':11A,19A,29A,60B,89B,94B,113B,117B,137B,144B,162C,170C,180C 'singl':18A,169C 'single-shar':17A,168C 'sourc':190C 'standard':205C 'still':145B 'suggest':221C 'unauthent':104B 'user':73B 'v1':22A,173C 'v2':24A,175C 'v2.6.0':238C 'v2/projects':86B 'version':197C,208C,232C 'via':15A,166C 'vikunja':1A,68B,70B,152C 'vulner':218C 'vx6f':43A 'write':122B,126B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-15T16:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6747","url":"https://pkg.go.dev/vuln/GO-2026-6747","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91985","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91985","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-91985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91985","severity":null,"published_at":"2026-09-15T16:17:57+00:00","modified_at":"2026-09-16T19:49:18+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91985:140","url":null,"severity":null,"published_at":"2026-10-23T21:44:36+00:00","modified_at":"2026-10-23T21:44:36+00:00","first_seen_at":"2026-10-23T21:44:36+00:00","fetched_at":"2026-10-23T21:44:36+00:00","note":"Read vendor GHSA-qfwc-vx6f-3g6g and GO-2026-6747: affected <= 2.5.0 (verified on 2.5.0, earlier likely), fixed 2.6.0. No exploitation or public-PoC beyond the advisory's own curl steps; social search not done (no CVE chatter expected). Release page v2.6.0 linked from pkg.go.dev but not read."}],"documents":[{"id":1231,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qfwc-vx6f-3g6g","title":"GHSA-qfwc-vx6f-3g6g Vikunja link-share hash disclosure","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1232,"url":"https://pkg.go.dev/vuln/GO-2026-6747","title":"GO-2026-6747","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1233,"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","title":"Vikunja v2.6.0","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}