CVE-2026-91983 in Vikunjainformación

Resumen

por MITRE • 2026-09-15

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

VulnCheck

Reservar

2026-09-15

Divulgación

2026-09-15

Moderación

aceptado

Artículo

VDB-404305

CPE

listo

EPSS

0.00000

KEV

no

Actividades

muy bajo

Fuentes

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-91983
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-91983
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-91983/

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!