CVE-2026-91983: Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.6.0 - Compensating control
Restrict API access to task read endpoints (where expand parameter is supported) to only clients/tokens that have the required scopes, until Vikunja is upgraded to 2.6.0.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid Vikunja API token with limited scopes. The issue affects task read endpoints when the attacker can supply the expand query parameter.
What data can be exposed?
Restricted task-related data returned through expansion can be accessed without the intended scope verification, including comments, reactions, and time entries. The provided severity vector indicates confidentiality impact only; no integrity or availability impact is stated.
Are deployments affected by default?
The issue is reachable over the network and does not require user interaction, but exploitation requires low-privileged access in the form of an API token. The provided information does not state whether any particular default token configuration grants the necessary access.
How can I determine whether I am affected?
Vikunja versions before 2.6.0 are affected. Review API use of task read endpoints for requests containing the expand parameter, especially requests made with restricted-scope tokens.