Is CVE-2026-68581 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68581 being exploited in the wild.

How severe is CVE-2026-68581?

High severity, with a CVSS score of 8.1, published 2 August 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) >= 0.22.0, <= 2.3.0, SEMVER:introduced=0.22.0, SEMVER:introduced=0.22.0,fixed=2.4.0; Vikunja 0.22.0 through 2.3.0.

Is there a fix for CVE-2026-68581?

Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68581 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-68581?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68581: Vikunja API token authentication bypass via link-share ID collision

Q: Is there a fix for CVE-2026-68581?

Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-68581 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-68581?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68581 · Severity: high · CVSS 8.1 · Published 2026-08-02

Vikunja is a task management and project collaboration platform. An authentication flaw in API token management allows an attacker to impersonate any user by creating a link-share with an ID matching a target user's numeric ID, then using that link-share to assume the target's identity and manage their API tokens. This enables account takeover and privilege escalation without requiring the target's password.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-68581 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68581 being exploited in the wild.
How severe is CVE-2026-68581?: High severity, with a CVSS score of 8.1, published 2 August 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) >= 0.22.0, <= 2.3.0, SEMVER:introduced=0.22.0, SEMVER:introduced=0.22.0,fixed=2.4.0; Vikunja 0.22.0 through 2.3.0.
Is there a fix for CVE-2026-68581?: Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68581 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-68581?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.vikunja.io/api (Go): upgrade to 2.4.0 or later
```
go get code.vikunja.io/api@v2.4.0
```

Technical details

The vulnerability is an authentication bypass in the /api/v1/tokens endpoints caused by insufficient principal type validation. Vikunja uses a generic web.Auth.GetID() interface that resolves both user IDs and link-share IDs through independent numeric sequences. An attacker can discover a target user's numeric ID through authenticated user search, then create link shares on a writable project until the link-share sequence reaches that target ID value. When a link-share JWT with that ID is presented to the token endpoints, it is mistakenly treated as a valid user identity. This allows the attacker to list, create, and delete the target user's API tokens, including issuing new tokens with arbitrary scopes. Authentication is required to discover user IDs and create link shares. The vulnerability was fixed in version 2.4.0.

Affected products

Vikunja Vikunja 0.22.0 through 2.3.0

Identifiers

CVE-2026-68581
GHSA-vvcv-vpph-h844
GO-2026-6753

Timeline

2026-08-02: disclosed: CVE-2026-68581 published
2026: patched: Fixed in version 2.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.