CVE-2026-76216: Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Vikunja deployments running version 2.4.0 or earlier should be treated as affected.
What must an attacker have to exploit this issue?
The attacker needs a link-share JWT and a numeric ID collision where the LinkSharing principal ID matches a victim user ID. The high attack-complexity rating reflects this collision requirement.
How can an organization determine whether a specific victim is exposed?
Exposure exists when a link-sharing principal and a victim user have the same autoincremented numeric ID. Those collisions can cause permission checks to treat the link-sharing principal as that user.