CVE-2026-91985: Vikunja Privilege Escalation Vulnerability

CVE-2026-91985 Overview

CVE-2026-91985 is an information disclosure vulnerability in Vikunja, an open-source task management platform. Versions before 2.6.0 fail to restrict access to the hash field returned by single-share read endpoints. Read-only members of a shared list can retrieve the link-share secret credential intended only for share owners. Attackers then exchange the disclosed hash for a link-share JSON Web Token (JWT) at the share's permission level. The result is horizontal and vertical privilege escalation, enabling unauthorized writes and administrative actions. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Read-only users can escalate to write or administrative privileges on shared Vikunja resources by exchanging a leaked share hash for an authenticated JWT.

Affected Products

Vikunja versions prior to 2.6.0
Self-hosted Vikunja deployments exposing the affected single-share read endpoints
Any Vikunja instance where link-shares are enabled for collaborative lists or projects

Discovery Timeline

2026-09-15 - CVE-2026-91985 published to the National Vulnerability Database
2026-09-16 - CVE record last modified in NVD

Technical Details for CVE-2026-91985

Vulnerability Analysis

Vikunja implements link-shares as a mechanism for sharing lists and projects with external or internal collaborators. Each share is bound to a permission level and identified by a secret hash value. That hash functions as a bearer credential, exchangeable at the share endpoint for a JWT scoped to the share's permission.

The single-share read endpoints return the full share object, including the hash field, to any member who has read access to the parent resource. Read-only participants therefore receive credentials that grant privileges beyond their assigned role. The disclosed hash is not restricted to owners or administrators.

Once an attacker holds the hash, exchanging it for a JWT is straightforward. The issued token carries the share's original permission level, which may include write access or administrative operations on the underlying list. This converts a passive read role into an active write role without requiring credential theft or session hijacking.

Root Cause

The root cause is missing output filtering on the serialized share object. The API returns sensitive credential material in the response payload without checking whether the requesting user's role permits access to the hash. This is a classic broken access control failure at the field level, mapped to [CWE-200].

Attack Vector

Exploitation requires network access and a read-only membership on any shared Vikunja resource. The attacker queries the single-share read endpoint for the target share, extracts the hash field from the JSON response, and submits it to the share authentication endpoint. The server returns a link-share JWT scoped to the share's original permission. The attacker then performs writes or administrative actions using that token. No user interaction is required beyond the initial API calls.

Technical details are documented in the GitHub Security Advisory GHSA-qfwc-vx6f-3g6g and the VulnCheck Privilege Escalation Advisory.

Detection Methods for CVE-2026-91985

Indicators of Compromise

Unexpected JWT issuance events from the link-share authentication endpoint originating from accounts that hold only read-only membership.
Write, update, or delete operations on shared lists performed under a link-share token that does not correspond to the resource owner's activity pattern.
Repeated API calls to single-share read endpoints from a user account followed shortly by share-token exchange requests.

Detection Strategies

Correlate access logs to identify sessions where a user first reads a share object and then presents a share hash to obtain a JWT within a short interval.
Alert on privilege elevation patterns where a read-only account performs write actions immediately after acquiring a link-share token.
Baseline normal share-token exchange volume per user and flag deviations that suggest hash harvesting.

Monitoring Recommendations

Enable verbose API request logging on the Vikunja backend, capturing endpoint paths, user identifiers, and response codes.
Ship application and access logs to a centralized analytics platform for retention and correlation across identity, endpoint, and network telemetry.
Monitor egress from Vikunja instances for anomalous outbound calls that may indicate scripted hash extraction.

How to Mitigate CVE-2026-91985

Immediate Actions Required

Upgrade all Vikunja instances to version 2.6.0 or later without delay.
Audit existing link-shares and rotate hashes for any share exposed to read-only members before the upgrade.
Review recent modifications to shared lists and projects for changes that read-only users could not legitimately have performed.

Patch Information

The maintainers addressed the issue in Vikunja 2.6.0 by removing the hash field from single-share read responses returned to non-privileged members. Administrators should follow the guidance in the GitHub Security Advisory GHSA-qfwc-vx6f-3g6g to complete the upgrade.

Workarounds

Disable link-sharing on sensitive lists and projects until the upgrade to 2.6.0 is complete.
Restrict membership on shared resources to trusted users only, minimizing exposure of the vulnerable endpoint.
Place the Vikunja API behind an authenticated reverse proxy that strips the hash field from single-share responses as a temporary compensating control.

bash

# Verify installed Vikunja version and upgrade via Docker
docker exec vikunja vikunja version
docker pull vikunja/vikunja:2.6.0
docker compose up -d vikunja