CVE-2026-111922: Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who are logged in to an affected Vikunja instance and visit attacker-controlled content served from any localhost or 127.0.0.1 port are exposed. The issue applies even if service.publicurl is configured.
What must an attacker do to exploit it?
The attacker must control a web page reachable through a localhost or 127.0.0.1 origin on any port and induce a logged-in user to interact with that page. The page can make a credentialed request to the token refresh endpoint and read the returned bearer JWT.
What is the impact if exploitation succeeds?
An attacker can obtain the logged-in user's bearer JWT and use it to take over that user's Vikunja account.
Which versions are affected?
Vikunja versions from 2.2.0 up to, but not including, 2.7.0 are affected.