Description
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | ≤ 2.4.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | code.vikunja.io/api | < 2.5.0 | 2.5.0 | GHSA-32r8-5843-4qw2 |
| Go | code.vikunja.io/api | all versions | — | GO-2026-6711 |
References
- GitHub Security Advisory (GHSA-32r8-5843-4qw2) vendor-advisory
- VulnCheck Advisory: Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing third-party-advisory