Is CVE-2026-111922 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111922 being exploited in the wild.

How severe is CVE-2026-111922?

Medium severity, with a CVSS score of 6.3, published 17 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 2.2.0 to 2.6.0.

Is there a fix for CVE-2026-111922?

Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111922 attacked?

It is attacked with local access or over the network, in a web application.

Am I affected by CVE-2026-111922?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111922: Vikunja permissive CORS configuration account takeover

CVE-2026-111922 · Severity: medium · CVSS 6.3 · Published 2026-10-17

Vikunja is a task management and productivity application that allows users to organize projects and tasks. The application has a misconfigured cross-origin policy that trusts all localhost connections with credentials, allowing an attacker running a malicious page on any local port to steal the logged-in user's authentication token and take over their account.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-111922 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111922 being exploited in the wild.
How severe is CVE-2026-111922?: Medium severity, with a CVSS score of 6.3, published 17 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 2.2.0 to 2.6.0.
Is there a fix for CVE-2026-111922?: Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111922 attacked?: It is attacked with local access or over the network, in a web application.
Am I affected by CVE-2026-111922?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.0

Technical details

Vikunja's CORS middleware defaults to trusting http://127.0.0.1:* and http://localhost:* origins with AllowCredentials=true, and this list is appended to rather than replaced by the configured publicurl. An attacker-controlled page on any localhost port can issue a credentialed fetch to the token refresh endpoint (/api/v1/login/refresh), which authenticates via HttpOnly cookie and returns a bearer JWT in the response body, allowing full account takeover. The SameSite=None cookie policy when using HTTPS further enables this cross-origin attack.

Affected products

Vikunja Vikunja 2.2.0 to 2.6.0

Identifiers

CVE-2026-111922
GHSA-m687-p538-r5hp
GO-2026-6739

Timeline

2026-10-03: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.