CVE-2026-91981 in Vikunjainformation

Résumé

par MITRE • 15/09/2026

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

VulnCheck

Réserver

15/09/2026

Divulgation

15/09/2026

Modérer

accepté

Entrée

VDB-404327

CPE

prêt

CWE

CWE-200 (confirmé)

CVSS

4.3 (CNA)

EPSS

0.00000

KEV

non

Activités

très faible

Sources

MITRE	https://www.cve.org/CVERecord?id=CVE-2026-91981
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-91981
CVE Details	https://www.cvedetails.com/cve/CVE-2026-91981/

◂ Précédent Aperçu Suivant ▸

Do you need the next level of professionalism?

Upgrade your account now!