CVE-2026-91981 in Vikunjainformación

Resumen

por MITRE • 2026-09-15

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

VulnCheck

Reservar

2026-09-15

Divulgación

2026-09-15

Moderación

aceptado

Artículo

VDB-404327

CPE

listo

EPSS

0.00000

KEV

no

Actividades

muy bajo

Fuentes

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-91981
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-91981
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-91981/

◂ AnteriorVisión De ConjuntoPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!