CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.
| CWE | CWE-863 |
| Vendor | go-vikunja |
| Product | vikunja |
| Published | Sep 15, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-vikunja vikunja
Be the first to know when new medium vulnerabilities affecting go-vikunja vikunja are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
go-vikunja / vikunja
1.0.0 < 2.6.0