CVE-2026-76216 in Vikunja
सारांश
द्वारा MITRE • 19/08/2026
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.