# CVE-2026-111922: Vikunja permissive CORS configuration account takeover

Source: https://junglewise.ai/threats/cve-2026-111922-vikunja-from-2-2-0-before-2-7-0-contains-a-permissive-cors  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111922 · Severity: medium · CVSS 6.3 · Published 2026-10-17

Vikunja is a task management and productivity application that allows users to organize projects and tasks. The application has a misconfigured cross-origin policy that trusts all localhost connections with credentials, allowing an attacker running a malicious page on any local port to steal the logged-in user's authentication token and take over their account.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api), [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-111922 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111922 being exploited in the wild.

**How severe is CVE-2026-111922?** Medium severity, with a CVSS score of 6.3, published 17 October 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) SEMVER:introduced=0; Vikunja 2.2.0 to 2.6.0.

**Is there a fix for CVE-2026-111922?** Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111922 attacked?** It is attacked with local access or over the network, in a web application.

**Am I affected by CVE-2026-111922?** Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.0

## Technical details

Vikunja's CORS middleware defaults to trusting http://127.0.0.1:* and http://localhost:* origins with AllowCredentials=true, and this list is appended to rather than replaced by the configured publicurl. An attacker-controlled page on any localhost port can issue a credentialed fetch to the token refresh endpoint (/api/v1/login/refresh), which authenticates via HttpOnly cookie and returns a bearer JWT in the response body, allowing full account takeover. The SameSite=None cookie policy when using HTTPS further enables this cross-origin attack.

## Affected products

- Vikunja Vikunja 2.2.0 to 2.6.0

## Identifiers

- CVE-2026-111922
- GHSA-m687-p538-r5hp
- GO-2026-6739

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp)
- [https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins](https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)