Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Vikunja link-share token can reveal user list

published 1 month ago

Summary

Versions of Vikunja older than 2.6.0 do not check link‑share tokens correctly in the API, allowing someone with a read‑only share link to list project members and verify usernames. This can expose employee names or other personal information. Update Vikunja to version 2.6.0 or newer to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Go	api	code.vikunja.io/api	<= 2.5.0

Original advisory text

Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vfxw-3x8p-2vjr. This link is maintained to preserve external references.

### Original Description
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.3 High

Type

CWE-200Information Exposure

Timeline

Published15 Sep 2026

Updated9 Oct 2026

First seen9 Oct 2026

Sources

GHSA-vcgv-7rvm-m3vp · OSV

Track software like this

Free during beta