CVE-2026-91981: Vikunja Information Disclosure Vulnerability

CVE-2026-91981 Overview

CVE-2026-91981 is a user enumeration vulnerability in Vikunja, an open-source task management platform, affecting versions before 2.6.0. The flaw stems from improper validation of link-share tokens in the v2 API user search endpoints. An attacker holding a read-only share link can enumerate project users through the projects endpoint. The same attacker can also confirm whether arbitrary usernames exist by querying the global search endpoint. The issue is classified as an Information Exposure weakness under CWE-200.

Critical Impact
Attackers with any read-only share link can enumerate internal users and validate arbitrary usernames, enabling targeted phishing and credential-based follow-on attacks.

Affected Products

Vikunja versions prior to 2.6.0
Vikunja v2 API user search endpoints (projects endpoint)
Vikunja v2 API global search endpoint

Discovery Timeline

2026-09-15 - CVE-2026-91981 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91981

Vulnerability Analysis

Vikunja exposes v2 API endpoints for searching users within projects and globally across the instance. These endpoints accept link-share tokens as an authentication mechanism, allowing shared project participants to interact with limited resources. In versions before 2.6.0, the token validation logic does not restrict the scope of user search operations to the shared project context. As a result, a read-only share token, which should only grant visibility into a single project, can be reused to query user data broadly.

The practical outcome is twofold. First, an attacker can list every user attached to a project through the projects user endpoint. Second, the attacker can submit arbitrary username queries against the global search endpoint and observe whether the platform returns a matching account. Both behaviors leak identity information that should require authenticated, authorized access.

Root Cause

The root cause is missing authorization enforcement on the v2 API user search handlers. Link-share tokens are accepted for authentication but the handlers fail to check whether the token's scope permits user enumeration. This is a classic broken access control pattern mapped to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Attack Vector

Exploitation requires only a valid read-only share link, which is often distributed widely or leaked through screenshots, email forwards, or public repositories. The attacker sends HTTP requests to the v2 user search endpoints while presenting the share token. No user interaction on the victim side is required. Refer to the GitHub Security Advisory GHSA-vfxw-3x8p-2vjr and the VulnCheck User Enumeration Advisory for endpoint-level technical detail.

Detection Methods for CVE-2026-91981

Indicators of Compromise

Repeated requests to Vikunja v2 API user search or global search endpoints originating from clients presenting the same link-share token.
High-volume username lookups against the global search endpoint returning both hit and miss responses.
Requests to project user listings from IP addresses that never authenticated as a full user account.

Detection Strategies

Parse Vikunja application and reverse proxy logs for v2 API paths related to user search and project user listing, correlated with share-token authentication.
Baseline normal share-link usage and alert on tokens that generate anomalous query volume or lookup patterns.
Flag requests where a single share token queries user data across multiple projects or issues broad username searches.

Monitoring Recommendations

Enable verbose access logging on the Vikunja API and forward logs to a centralized SIEM or data lake for retention and query.
Monitor egress web traffic from Vikunja hosts for scraping patterns consistent with enumeration tooling.
Track newly created or shared link tokens and correlate their activity against expected user populations.

How to Mitigate CVE-2026-91981

Immediate Actions Required

Upgrade Vikunja to version 2.6.0 or later on all self-hosted instances.
Rotate or revoke existing link-share tokens that were issued before the upgrade, especially any shared broadly or externally.
Audit historical access logs for signs of user enumeration prior to patching.

Patch Information

The fix is available in Vikunja 2.6.0, which enforces proper scope validation on link-share tokens across the v2 API user search endpoints. See the GitHub Security Advisory GHSA-vfxw-3x8p-2vjr for release notes and remediation guidance.

Workarounds

Disable link sharing on projects containing sensitive user membership until the upgrade is complete.
Restrict access to the Vikunja instance behind an authenticated reverse proxy or VPN to limit exposure of the v2 API.
Apply web application firewall rules that block unauthenticated or share-token requests to v2 user search endpoints.

bash

# Example WAF rule concept: block share-token requests to user search endpoints
# (adapt to your WAF syntax; validate against Vikunja API paths in your deployment)
location ~ ^/api/v2/(projects/[0-9]+/users|users/search) {
    if ($http_authorization ~* "ShareToken") {
        return 403;
    }
    proxy_pass http://vikunja_upstream;
}