HIGH 8.1 GitHub
CVE-2026-68581
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
Executive Summary
Vikunja accepts both regular-user JSON Web Tokens (JWTs) and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a `models.LinkSharing` principal whose `GetID()` method returns the numeric `link_shares.id`. The API-token management model then treats that generic numeric value as a `users.id` when it creates, lists, and deletes API tokens.
Because `users.id` and `link_shares.id` are independent positive sequences, a link share whose
Affected Products
- go/code.vikunja.io/api >= 0.22.0, <= 2.3.0
References
- https://github.com/advisories/GHSA-vvcv-vpph-h844
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vvcv-vpph-h844
- https://nvd.nist.gov/vuln/detail/CVE-2026-68581
- https://github.com/go-vikunja/vikunja/commit/95b7e673fb5ee407498fa4b13e8b4c57847a4a0b
This high severity vulnerability with a CVSS score of 8.1 was published on 2026-10-09 via GitHub. Affected: go/code.vikunja.io/api >= 0.22.0, <= 2.3.0.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.