CVE-2026-91983: Vikunja API Token Scope Bypass Vulnerability

CVE-2026-91983 Overview

CVE-2026-91983 is an authorization bypass vulnerability in Vikunja, an open-source task management application, affecting all versions before 2.6.0. The flaw resides in task read endpoints where authorization checks fail to inspect query string parameters. Attackers holding an API token with limited scopes can supply the expand query parameter to retrieve restricted data including comments, reactions, and time entries. The issue is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers with narrow API token scopes can read task-related data outside the granted permission boundary by appending the expand parameter to task read requests.

Affected Products

Vikunja versions prior to 2.6.0
Vikunja API server component handling task read endpoints
Deployments issuing scoped API tokens to users or integrations

Discovery Timeline

2026-09-15 - CVE-2026-91983 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91983

Vulnerability Analysis

Vikunja enforces API token scopes to restrict which resources a token can read or modify. The task read endpoints validate the requested route against the token's granted scopes, but the authorization logic does not evaluate query string parameters that influence the returned payload. When a client appends expand to a task read request, the handler joins additional related entities such as comments, reactions, and time entries into the response. Because the scope check ignores this parameter, a token authorized only for basic task reads receives data that should require separate, higher-privileged scopes.

Root Cause

The root cause is an authorization decision made on the route and HTTP method alone rather than on the effective data set returned. The handler treats expand as a presentation option instead of a privileged action. This aligns with CWE-863: Incorrect Authorization, where the system performs an authorization check but uses the wrong criteria.

Attack Vector

Exploitation requires a valid Vikunja API token with any task read scope. The attacker sends a standard task read request over the network and appends expand values corresponding to restricted relations. The server returns the expanded objects without verifying that the token holds the scopes normally required to read comments, reactions, or time entries. No user interaction is needed, and the attack complexity is low.

Refer to the VulnCheck Vikunja API Token Advisory and the GitHub Security Advisory GHSA-9rg3-v78m-26q8 for endpoint-level details.

Detection Methods for CVE-2026-91983

Indicators of Compromise

API access logs showing task read requests that include the expand query parameter from tokens with narrow scopes.
Unexpected retrieval of comment, reaction, or time-entry data associated with tokens that were never granted those scopes.
Repeated enumeration patterns against task read endpoints from a single API token or client IP.

Detection Strategies

Correlate API token identifiers with the scopes granted at issuance and flag responses that contain data types outside those scopes.
Parse reverse proxy or application logs for expand= parameters on /api/v1/tasks routes and cross-reference the calling token's permissions.
Establish a baseline of expected expand usage per integration and alert on deviations.

Monitoring Recommendations

Enable verbose request logging on the Vikunja API tier, capturing full query strings and authenticated token metadata.
Forward Vikunja access logs to a centralized analytics platform for retrospective hunting once the vulnerable window is known.
Review audit trails of API token creation and usage to identify tokens active during the vulnerable release window.

How to Mitigate CVE-2026-91983

Immediate Actions Required

Upgrade Vikunja to version 2.6.0 or later on all API server instances.
Rotate API tokens issued before the upgrade, especially those distributed to third-party integrations.
Audit historical access logs for expand parameter use by tokens that lack the corresponding scopes.

Patch Information

The Vikunja maintainers resolved the vulnerability in release 2.6.0 by extending the authorization check on task read endpoints to inspect the expand parameter and require the appropriate scopes for each expanded relation. Details are available in the GitHub Security Advisory GHSA-9rg3-v78m-26q8.

Workarounds

Restrict API token issuance to trusted users and integrations until the upgrade completes.
Place the Vikunja API behind a reverse proxy that strips or rejects the expand query parameter for tokens with limited scopes.
Reduce the lifetime of existing API tokens and revoke any tokens that are not actively required.

bash

# Example NGINX rule to block expand parameter on task read endpoints
location ~ ^/api/v1/tasks {
    if ($arg_expand) {
        return 403;
    }
    proxy_pass http://vikunja_backend;
}