CVE-2026-91983CWE-863broken-access-control

CVE-2026-91983

Medium · published September 15, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-15T20:17Z
References (3)
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rg3-v78m-26q8 · [email protected]https://www.vulncheck.com/advisories/vikunja-before-2.6.0-api-token-scope-bypass-via-expand-parameter · [email protected]https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rg3-v78m-26q8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:18Z
    Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
    cvelistv5