Executive brief
Vikunja is a task management and project collaboration platform. An authentication flaw in API token management allows an attacker to impersonate any user by creating a link-share with an ID matching a target user's numeric ID, then using that link-share to assume the target's identity and manage their API tokens. This enables account takeover and privilege escalation without requiring the target's password.
Technical details
The vulnerability is an authentication bypass in the /api/v1/tokens endpoints caused by insufficient principal type validation. Vikunja uses a generic web.Auth.GetID() interface that resolves both user IDs and link-share IDs through independent numeric sequences. An attacker can discover a target user's numeric ID through authenticated user search, then create link shares on a writable project until the link-share sequence reaches that target ID value. When a link-share JWT with that ID is presented to the token endpoints, it is mistakenly treated as a valid user identity. This allows the attacker to list, create, and delete the target user's API tokens, including issuing new tokens with arbitrary scopes. Authentication is required to discover user IDs and create link shares. The vulnerability was fixed in version 2.4.0.
Affected products
- Vikunja Vikunja 0.22.0 through 2.3.0
Timeline
- 2026-08-02: disclosed: CVE-2026-68581 published
- 2026: patched: Fixed in version 2.4.0