Is CVE-2026-76216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76216 being exploited in the wild.

How severe is CVE-2026-76216?

High severity, with a CVSS score of 7.5, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) <= 2.4.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.4.0; Vikunja <= 2.4.0.

How is CVE-2026-76216 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76216?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76216: Vikunja link-share principal-type confusion in permission checks

Q: Is there a fix for CVE-2026-76216?

No fixed version is recorded yet. Disable link sharing via configuration (`ServiceEnableLinkSharing.setDefault(false)`) until upgrading, or apply the suggested fix to add principal-type guards to the three vulnerable permission checks: `TeamMember.CanDelete`, `BotUser.isOwner`, and `Team.CanRead`. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

CVE-2026-76216 · Severity: high · CVSS 7.5 · Published 2026-10-09

Vikunja is a task management and organization system. A bug in permission validation allows a guest with a public share link to be mistakenly treated as a specific user in certain contexts, enabling them to remove that user from teams, delete their bot accounts, and read team rosters without authorization.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-76216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76216 being exploited in the wild.
How severe is CVE-2026-76216?: High severity, with a CVSS score of 7.5, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) <= 2.4.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.4.0; Vikunja <= 2.4.0.
Is there a fix for CVE-2026-76216?: No fixed version is recorded yet. Disable link sharing via configuration (`ServiceEnableLinkSharing.setDefault(false)`) until upgrading, or apply the suggested fix to add principal-type guards to the three vulnerable permission checks: `TeamMember.CanDelete`, `BotUser.isOwner`, and `Team.CanRead`.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76216 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76216?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable link sharing via configuration (`ServiceEnableLinkSharing.setDefault(false)`) until upgrading, or apply the suggested fix to add principal-type guards to the three vulnerable permission checks: `TeamMember.CanDelete`, `BotUser.isOwner`, and `Team.CanRead`.</anigation> </invoke>

Technical details

The `web.Auth` interface is implemented by both user principals and link-sharing principals, but three permission checks—`TeamMember.CanDelete`, `BotUser.isOwner`, and `Team.CanRead`—compare the raw positive `LinkSharing.GetID()` directly against user IDs without the principal-type guard that exists in sibling methods. When a link-share ID N numerically matches a user's ID N, the link-share is treated as that user, bypassing authorization. The vulnerability requires default-enabled link sharing and ID collision based on autoincrement sequencing.

Affected products

Vikunja Vikunja <= 2.4.0

Identifiers

CVE-2026-76216
GHSA-32r8-5843-4qw2
GO-2026-6711

Timeline

2026-10-09: disclosed: GHSA-32r8-5843-4qw2 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.