What is CVE-2026-68581?
CVE-2026-68581 is a vulnerability in Vikunja versions 0.22.0 through 2.3.0 caused by missing principal type validation in API token management. Due to independent numeric sequences for user IDs and link-share IDs, a link-share JWT with an ID matching a target user's ID is incorrectly resolved as that user through the generic web.Auth.GetID() interface, potentially allowing unauthorized access. Affected instances should be updated immediately and token validation mechanisms strengthened.
Related CVEs
link basis: same weakness class CWE-863
FAQ2
Which versions of Vikunja are affected by CVE-2026-68581?
This vulnerability affects Vikunja versions from 0.22.0 through 2.3.0.
How can CVE-2026-68581 lead to unauthorized access?
Due to missing principal type validation in API token management, a link-share JWT with a numeric ID matching a target user's ID can be incorrectly resolved as that user through the generic web.Auth.GetID() interface.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.