CVE-2026-76216 in Vikunja
Summary
by MITRE • 08/19/2026
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Vikunja versions up to 2.4.0 represents a critical principal-type confusion flaw rooted in insufficient input validation during permission checks. This security defect arises from the application's failure to distinguish between different types of principals, specifically confusing link-sharing identifiers with user account identifiers. In typical web applications, access control mechanisms rely on unique and distinct identity tokens or IDs to enforce permissions correctly. However, in this instance, three specific permission check functions lack necessary type guards that would verify whether an incoming identifier corresponds to a valid user principal before processing it as such. This architectural oversight allows the system to treat any numeric ID provided within a link-sharing context as if it were a standard user database primary key, thereby bypassing intended security boundaries.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and unauthorized data manipulation. An attacker possessing a valid link-share JSON Web Token can exploit these missing type checks by submitting numeric IDs that collide with existing auto-incremented user identifiers in the database. By leveraging id collisions within the autoincrement space, an adversary can effectively impersonate other users or entities without needing their actual credentials. This capability enables several malicious actions including removing legitimate victims from teams, which disrupts collaborative workflows and denies service to affected parties. Furthermore, attackers can enumerate bot accounts by probing for existing IDs that match user identifiers, leading to the deletion of these automated agents. The ability to read team rosters further exacerbates the risk by exposing sensitive organizational structure information to unauthorized individuals.
From a technical classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and specifically relates to CWE-639 Authorization Bypass Through User-Controlled Key. The lack of type validation on principal identifiers is a classic example of trusting user-supplied input without verifying its semantic meaning or context within the application's security model. This flaw allows an attacker with lower-level privileges associated with link sharing to perform actions reserved for higher-privilege roles such as team administrators or system owners. The exploitation relies heavily on the predictability and sequential nature of database auto-increment fields, which are commonly used in relational databases like MySQL or PostgreSQL that Vikunja supports.
In terms of threat modeling, this vulnerability can be mapped to MITRE ATT&CK techniques involving unauthorized access and data exfiltration. Specifically, it relates to T1078 Valid Accounts where an attacker uses valid but potentially misinterpreted credentials or tokens to gain access. The enumeration aspect connects to T1087 Account Discovery as attackers probe for existing user IDs through the link-share interface. The deletion of bot users falls under T1499 Endpoint Denial of Service if it impacts system stability, though more accurately it represents unauthorized modification of critical assets (T1083 File and Directory Discovery or T1565 Data Manipulation).
To mitigate this vulnerability, immediate patching to a version greater than 2.4.0 is required as the developer has addressed these permission checks by implementing proper type guards. These safeguards ensure that link-sharing principals are strictly validated against their intended scope and cannot be coerced into acting as user principals. Additionally, organizations should review their database configurations for predictable auto-increment sequences which can facilitate such id collision attacks in other contexts. Implementing UUIDs instead of sequential integers for primary keys is a recommended long-term architectural improvement to prevent ID-based enumeration and confusion vulnerabilities across the entire application stack. Regular security audits focusing on access control logic are also advised to detect similar flaws where input validation may be insufficient or incorrectly implemented.