CVE-2026-91985: Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.6.0 - Configuration
Update Vikunja so single-share read endpoints properly restrict access to the link-share hash field, preventing read-only members from obtaining the share's secret credential.
Vikunja link-share single-share read endpoints Access control for link-share hash field = restricted (read-only members must not be able to obtain the share's secret credential)
Event History
Frequently Asked Questions
Who is exposed to this issue?
Vikunja instances before 2.6.0 are affected where a read-only member can access a single-share read endpoint that exposes a link-share hash. The disclosed hash can be exchanged for a JWT carrying the link share's permission level.
What access does an attacker need to exploit it?
An attacker needs read-only membership and access to the affected single-share read endpoint. No separate administrative privileges are required before obtaining the hash.
What can an attacker do after obtaining the link-share hash?
They can exchange the hash for a link-share JWT and operate at the permission level assigned to that share. This can enable unauthorized writes or administrative actions when the share grants those permissions.
How can I tell whether my deployment is affected?
Deployments running Vikunja before 2.6.0 should be considered affected. Review whether read-only members can retrieve link-share hashes through single-share read endpoints.