# Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Source: https://junglewise.ai/threats/duplicate-advisory-vikunja-link-share-principal-id-collision-allows-8ec9cedc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.1 · Published 2026-08-02

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vvcv-vpph-h844. This link is maintained to preserve external references.

### Original Description
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Fixed in version 2.4.0.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.1, published 2 August 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) >= 0.22.0, <= 2.3.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected?** Check whether you run code.vikunja.io/api (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- code.vikunja.io/api (Go) >= 0.22.0, <= 2.3.0

## Related threats

- [Vikunja CalDAV relation creation bypasses authorization](https://junglewise.ai/threats/go-2026-6732-vikunja-caldav-relation-creation-bypasses-taskrelation-65a4724c)
- [Vikunja task relation deletion missing authorization check](https://junglewise.ai/threats/go-2026-6754-vikunja-task-relation-deletion-does-not-check-read-access-9f93429b)
- [Vikunja cross-project task disclosure through subtask expansion](https://junglewise.ai/threats/go-2026-6714-vikunja-cross-project-task-disclosure-through-subtask-cba3685c)
- [Vikunja information disclosure in task assignees endpoint](https://junglewise.ai/threats/go-2026-6723-vikunja-assignee-email-addresses-disclosed-to-read-only-e328c145)
- [Vikunja permissive CORS configuration account takeover](https://junglewise.ai/threats/cve-2026-111922-vikunja-from-2-2-0-before-2-7-0-contains-a-permissive-cors)