CVE-2026-91980 Overview
CVE-2026-91980 affects Vikunja, an open-source task management application, in all versions prior to 2.6.0. The vulnerability allows authenticated users to enumerate arbitrary teams and their members through the project teams endpoint. Vikunja fails to validate whether the requesting user has legitimate access to a team before attaching it to a project. Attackers can iterate through team IDs and retrieve complete rosters, including member names and administrator flags for teams they should not access. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Any authenticated Vikunja user can enumerate every team in the instance and harvest member identities, exposing organizational structure and privileged accounts for follow-on targeting.
Affected Products
- Vikunja versions prior to 2.6.0
- Self-hosted Vikunja instances with multi-team configurations
- Vikunja deployments exposing the project teams API endpoint
Discovery Timeline
- 2026-09-15 - CVE-2026-91980 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91980
Vulnerability Analysis
The vulnerability resides in Vikunja's project sharing workflow, specifically in the endpoint that attaches teams to projects. The application authenticates the requesting user and confirms project ownership but omits a permission check on the supplied team identifier. Any authenticated user can therefore submit arbitrary team IDs and receive full team metadata in the response.
The returned payload includes member names and administrator flags, converting a broken access control issue into a broader information disclosure. Attackers can script sequential ID enumeration to build a complete map of teams, members, and privileged accounts across the instance.
Root Cause
The root cause is a missing authorization check on the team resource during the project-team association request. Vikunja verifies that the caller can modify the target project but does not verify that the caller has read or membership rights on the team being attached. This is a classic broken object-level authorization pattern, matching CWE-200.
Attack Vector
Exploitation requires only a low-privilege authenticated account and network access to the Vikunja API. An attacker creates a project they control, then iterates team IDs via the project teams endpoint. Each successful attach operation returns team details, including member records. See the GitHub Security Advisory GHSA-39p5-2wrr-xh29 and the VulnCheck Vulnerability Advisory for technical details.
No verified public exploit code is available. The attack can be reproduced with standard HTTP tooling against the authenticated API.
Detection Methods for CVE-2026-91980
Indicators of Compromise
- Repeated POST or PUT requests to the project teams endpoint from a single authenticated user with sequentially incrementing team ID values.
- Unusual volume of team attach operations tied to newly created or rarely used projects.
- API responses returning team member data to users with no prior interaction history with those teams.
Detection Strategies
- Enable verbose API access logging on Vikunja and alert on high-frequency team attach requests from individual accounts.
- Correlate project creation events with immediate bulk team attachment activity to surface enumeration behavior.
- Baseline normal team management activity per user role and flag deviations exceeding the baseline.
Monitoring Recommendations
- Forward Vikunja application logs and reverse-proxy access logs to a centralized SIEM for query and retention.
- Monitor authentication logs for accounts issuing large numbers of API calls in short time windows.
- Review audit trails for unexpected changes to project team memberships following the upgrade.
How to Mitigate CVE-2026-91980
Immediate Actions Required
- Upgrade all Vikunja instances to version 2.6.0 or later without delay.
- Rotate credentials for any privileged accounts whose names may have been exposed through enumeration.
- Audit recent project team attachment activity and remove unauthorized team associations.
Patch Information
The Vikunja maintainers addressed the missing authorization check in version 2.6.0. Upgrade instructions and the full advisory are available in the GitHub Security Advisory GHSA-39p5-2wrr-xh29.
Workarounds
- Restrict network access to the Vikunja API to trusted users and networks while patching is planned.
- Disable self-service account registration to limit the pool of authenticated actors that can exploit the endpoint.
- Place the project teams endpoint behind a reverse-proxy rule that rate-limits or blocks bulk sequential ID access patterns.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.