CVE Feed

    Dashboard / CVE / CVE-2026-76216

    CVE-2026-76216

    Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

    Published:Aug 19, 2026
    Last Modified:Aug 19, 2026
    EPS:Aug 19, 2026
    EPSS Score:
    CVSS Score:7.5

    Affected Products

    Vendor
    Vikunja
    Product
    Vikunja

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-68582 (CVSS 9.3) — Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in th…
    CVE-2026-68581 (CVSS 8.6) — Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because use…
    CVE-2026-56765 (CVSS 9.3) — Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashe…
    CVE-2026-40103 (CVSS 4.3) — Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enf…
    CVE-2026-35602 (CVSS 5.4) — Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoi…
    CVE-2026-35601 (CVSS 4.1) — Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator bu…
    CVE-2026-35600 (CVSS 5.4) — Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded direc…
    CVE-2026-35599 (CVSS 6.5) — Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime fu…
    CVE-2026-35598 (CVSS 4.3) — Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and Get…
    CVE-2026-35597 (CVSS 5.9) — Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockou…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High