Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Also known as GHSA-32r8-5843-4qw2, GO-2026-6711

Published 2 mo ago 2026-08-19 · modified 10 d ago 2026-10-27 · JSON

CVSS

7.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 30%

Public exploits

none known

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 mo ago 2026-08-20

Exploit prediction (EPSS)

0.36% probability of exploitation in the next 30 days, higher than 30% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	7.7	`CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
CNA	4.0	7.7	`CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
GitHub	3.1	7.5	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`code.vikunja.io/api`	<2.5.0 all versions	2.5.0

Affected products

go-vikunja vikunja

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-843 Access of Resource Using Incompatible Type
CWE-863 Incorrect Authorization

References

github.com /go-vikunja/vikunja/security/advisories/GHSA-32r8-5843-4qw2 · vendor-advisory
vulncheck.com /advisories/vikunja-through-principal-type-confusion-via-linksharing · third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2026-76216 · advisory
github.com /go-vikunja/vikunja/commit/a717d64d5658708ba390f18dd697f5e567e68aac · web
github.com /go-vikunja/vikunja · package
github.com /go-vikunja/vikunja/releases/tag/v2.5.0 · web

Sources

CVE List: CVE-2026-76216
GitHub Advisory: GHSA-32r8-5843-4qw2
NVD: CVE-2026-76216
OSV: GO-2026-6711

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary