CVE-2026-76216CWE-639

CVE-2026-76216

High · published August 19, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-19T18:17Z
References (2)
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-32r8-5843-4qw2 · [email protected]https://www.vulncheck.com/advisories/vikunja-through-principal-type-confusion-via-linksharing · [email protected]
EPSS history
Timeline
  • 19 AUG 14:02Z
    Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
    cvelistv5