CVE-2026-91985 — Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret crede…
Published: 2026-09-15 · CVSS: 8.7 · CVSS 4.0
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7