Verified

ghsa:GHSA-9XWC-VWWW-QQMW: code.vikunja.io/api <= 2.4.0

Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure. Affected range: <= 2.4.0.

Affected technology

code.vikunja.io/api · <= 2.4.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space. Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.

Published 13-Oct-2026 07:48 UTC

Product: code.vikunja.io/api
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-09 22:06:25.045838+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-9xwc-vwww-qqmw.html