CVE-2026-76216 — Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permiss…
Published: 2026-08-19 · CVSS: 7.7 · CVSS 4.0
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7