CVE-2026-91981: Vikunja before 2.6.0 User Enumeration via v2 API
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a read-only share link. No interactive user action is required, and the vulnerable endpoints are reachable over the network.
What information can an attacker obtain?
A holder of a read-only share link can enumerate users associated with a project through the projects endpoint. They can also use the global search endpoint to confirm whether arbitrary usernames exist.
Which deployments are affected?
Vikunja versions earlier than 2.6.0 are affected. The issue concerns v2 API user search endpoints when link-share tokens are not properly validated.
How can I determine whether my instance is vulnerable?
Check the deployed Vikunja version. Instances running a version before 2.6.0 should be treated as affected, particularly where read-only share links are issued.