CVE-2026-68581 go-vikunja CVE debrief

Who should care

Administrators and users of Vikunja versions 0.22.0 through 2.3.0, security teams monitoring for authentication bypass vulnerabilities, and developers using Vikunja for project management should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested, with the item only closed after evidence is documented. Asset inventory and vulnerability management teams should also review their systems for potential exposure and implement necessary controls to prevent exploitation. Security teams should monitor for suspicious API token activities and implement exception tracking to detect potential attacks. In addition, defenders should verify the authenticity of API tokens and implement additional security measures to prevent token manipulation. The CVE record provides additional context and information about the vulnerability, which can be used to inform risk management and remediation efforts. By taking these steps, organizations can help protect their systems from potential attacks and minimize the risk of exploitation. To further protect against this vulnerability, defenders should consider implementing compensating controls, such as additional authentication or authorization checks, to prevent unauthorized access to API tokens. They should also review their incident response plans to ensure they are prepared to respond to potential attacks. Furthermore, security teams should consider conducting regular security audits and penetration testing to identify and address potential vulnerabilities before they can be exploited. By prioritizing vulnerability management and taking proactive steps to protect their systems, organizations can to

Technical summary

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management, allowing an authenticated attacker to bypass authentication and manipulate API tokens of other users. The attacker can obtain a target user's numeric ID, create link shares on an attacker-writable project, and use the resulting link-share JWT to list, create, and delete the target user's API tokens. This vulnerability has been fixed in version 2.4.0.

Defensive priority

Authenticated attackers can bypass authentication and list, create, and delete API tokens of other users, including issuing new tokens with attacker-chosen scopes.

Recommended defensive actions

• Inventory and verify Vikunja versions 0.22.0 through 2.3.0 for potential exposure
• Implement compensating controls to monitor and restrict API token management
• Apply vendor remediation by upgrading to Vikunja version 2.4.0 or later
• Monitor for suspicious API token activities and implement exception tracking
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Vikunja versions 0.22.0 through 2.3.0 have an authentication bypass vulnerability due to improper validation of principal types in API token management. An attacker can obtain a target user's numeric ID via authenticated user search, create link shares on an attacker-writable project, and use the resulting link-share JWT to manipulate the target user's API tokens.

Official resources