Is CVE-2026-57458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57458 being exploited in the wild.

How severe is CVE-2026-57458?

High severity, with a CVSS score of 8.1, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) = 2.3.0, SEMVER:introduced=0, SEMVER:introduced=2.3.0,fixed=2.4.0.

Is there a fix for CVE-2026-57458?

Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57458 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-57458?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57458: Vikunja scoped API token permission bypass in OAuth

CVE-2026-57458 · Severity: high · CVSS 8.1 · Published 2026-10-09

Vikunja is a task management and project planning platform. A narrowly scoped API token intended to have limited permissions can be misused to obtain full session credentials through the OAuth authorization flow, allowing an attacker to bypass the token's permission restrictions and access data the original token was not granted access to.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-57458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57458 being exploited in the wild.
How severe is CVE-2026-57458?: High severity, with a CVSS score of 8.1, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) = 2.3.0, SEMVER:introduced=0, SEMVER:introduced=2.3.0,fixed=2.4.0.
Is there a fix for CVE-2026-57458?: Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57458 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-57458?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.vikunja.io/api (Go): upgrade to 2.4.0 or later
```
go get code.vikunja.io/api@v2.4.0
```

Technical details

A scoped API token with only `oauth.authorize` permission can call the OAuth authorization endpoint and exchange the authorization code for a normal JWT bearer token and refresh token that are not bound to the original API token's permission scope. The vulnerability stems from an authentication-context mismatch where the OAuth authorization server accepts API-token-authenticated requests as valid resource owners and issues unrestricted credentials. An attacker with a limited-scope API token can exploit this to access endpoints that the original token scope should have prevented.

Affected products

Vikunja Vikunja

Identifiers

CVE-2026-57458
GHSA-v3p6-34mc-hj7v
GO-2026-6750

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.