CVE-2026-76216
HighCVSS 7.5Summary
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Risk Assessment
Risk of unauthorized access to data and manipulation of user accounts in Vikunja, potentially leading to confidentiality and integrity breaches.
Recommendation
Update Vikunja to a patched version. Restrict access to share links and monitor activity for unusual operations.
Original NVD description (English source)
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.