CVE-2026-76216 Overview
CVE-2026-76216 is a principal-type confusion vulnerability in the Vikunja task management platform through version 2.4.0. The flaw exists at three permission checks that lack type guards, causing LinkSharing principals with id N to be treated as user principals where users.id == N. An attacker holding a valid link-share JSON Web Token (JWT) can abuse identifier collisions in the autoincrement space to perform actions against real users. The impact includes removing victims from teams, enumerating and deleting victim bot users, and reading team rosters. The weakness is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated link-share holders can impersonate user identities by ID collision, enabling unauthorized team modification, bot user deletion, and team roster disclosure.
Affected Products
- Vikunja through 2.4.0
- Deployments exposing link-share functionality with JWT authentication
- Instances where LinkSharing IDs overlap with active users.id values
Discovery Timeline
- 2026-08-19 - CVE-2026-76216 published to the National Vulnerability Database (NVD)
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76216
Vulnerability Analysis
Vikunja distinguishes between two principal types: authenticated users and link-share principals issued via JWT. Both principal types use integer identifiers drawn from independent autoincrement spaces. Three permission-check code paths compare the numeric id field of the caller against users.id without first verifying the principal type. When a link-share principal with id N invokes these endpoints, the authorization layer resolves N to a user record if one exists with the same identifier.
This conflation grants a link-share holder the effective permissions of the collision-matched user for the affected operations. The attacker does not need to authenticate as the victim or possess the victim's credentials. Instead, they rely on the deterministic overlap of sequential IDs across two principal tables.
Root Cause
The root cause is missing type discrimination in authorization logic. The three vulnerable checks assume the caller is always a user principal and dereference the id field directly against users.id. No guard verifies that the principal originated from the users table before applying user-scoped permissions. This is a classic instance of [CWE-639], where a user-controlled key is trusted without contextual validation.
Attack Vector
An attacker first obtains a link-share JWT, which is designed for restricted, shareable access to a project. They enumerate their own link-share id, then target three endpoints: team member removal, bot user enumeration and deletion, and team roster reads. Because the checks match the link-share id against users.id, the attacker acts under the identity of the colliding user. The vulnerability is exploitable over the network without user interaction, though it requires low-privileged authentication via the link-share token.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-32r8-5843-4qw2 and the VulnCheck Advisory on Vikunja for technical details.
Detection Methods for CVE-2026-76216
Indicators of Compromise
- Unexpected team member removals correlated with requests authenticated by a link-share JWT rather than a user session
- Deletion or enumeration of bot user accounts that were not initiated by an administrator
- Team roster read operations originating from link-share tokens whose scope should not include member listings
- Application logs showing authorization decisions where the principal type is LinkSharing but the effective action targets user-scoped resources
Detection Strategies
- Inspect Vikunja application logs for requests carrying a link-share JWT that invoke team management or bot user endpoints
- Correlate link_share_id values with users.id collisions in the database and flag overlapping identifiers
- Alert on any DELETE operation against bot users when the acting principal is a link-share token
Monitoring Recommendations
- Enable verbose authorization logging in Vikunja to capture principal type on every permission decision
- Forward Vikunja access logs into a centralized analytics platform for retrospective hunting across principal-type anomalies
- Baseline normal link-share activity and alert on deviations that touch team or user administration endpoints
How to Mitigate CVE-2026-76216
Immediate Actions Required
- Upgrade Vikunja to a version later than 2.4.0 that introduces principal-type guards on the affected permission checks
- Audit existing link-share tokens and revoke tokens that are no longer required
- Review recent team membership changes, bot user deletions, and roster access events for unauthorized activity
- Restrict link-share creation to trusted users until the patched release is deployed
Patch Information
Refer to the GitHub Security Advisory GHSA-32r8-5843-4qw2 for the fixed version and remediation guidance from the Vikunja maintainers. The fix introduces explicit principal-type checks so that a LinkSharingid is never compared against users.id.
Workarounds
- Disable link sharing at the instance level until the upgrade is applied
- Rotate all outstanding link-share JWTs to invalidate tokens that could be used for exploitation
- Apply network-level restrictions to limit which clients can present link-share tokens to the API
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
