Executive brief
Vikunja is a self-hosted task management and project organization platform with an API for integrations. A scope bypass vulnerability allows users with restricted API tokens (intended only for reading tasks) to access sensitive data like comments, reactions, and time entry information by manipulating query parameters, potentially exposing data that should be protected by the token's limited permissions.
Technical details
The vulnerability is an authorization bypass (CWE-863) in Vikunja's API token permission enforcement. The authorization check in models.CanDoAPIRoute only examines the HTTP method and route path, ignoring query string parameters. Task read endpoints (GET /api/v1/tasks/:task, GET /api/v1/tasks, and v2 equivalents) accept an "expand" parameter that embeds data from restricted permission groups (tasks_comments, reactions, time_entries) without verifying the token holds the required scopes. An attacker with a token scoped to "tasks: [read_all]" can append "?expand=comments" to bypass the authorization check that normally returns 401 for direct access to GET /api/v2/tasks/:task/comments. The vulnerability affects versions 1.0.0 through 2.5.0 and is fixed in 2.6.0. The impact is limited to read-only access to data the token owner already has visibility to, but violates the principle of least privilege for third-party integrations.
Affected products
- Vikunja Vikunja 1.0.0 through 2.5.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-9rg3-v78m-26q8 published
- 2026-09-15: advisory: CVE-2026-91983 published on NVD
- 2026-09-15: patched: Fixed in Vikunja 2.6.0