CVE-2026-76216 go-vikunja CVE debrief

Who should care

Defenders responsible for Vikunja deployments, particularly those using link-sharing features, should assess exposure and prioritize patching to prevent potential cross-account team removal, bot takeover, and roster disclosure.

Why it matters

Defenders should care about CVE-2026-76216 because it allows link-share principals to be treated as users with matching IDs, potentially leading to unauthorized actions such as cross-account team removal, bot takeover, and roster disclosure in Vikunja deployments.

• Potential cross-account team removal
• Potential bot takeover through principal-type-confusion
• Potential roster disclosure through unauthorized access

Technical summary

Vikunja's `web.Auth` interface is satisfied by both `*user.User` and `*models.LinkSharing`, leading to principal-type-confusion. A link-share's `GetID()` returns the raw positive `share.ID`, which lives in the same positive autoincrement ID space as `users.id`. Three permission methods compare this raw ID directly and omit the link-share type guard, allowing link-share principals to be treated as users with matching IDs.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying patches to prevent potential cross-account team removal, bot takeover, and roster disclosure.

Recommended defensive actions

• Verify affected versions of Vikunja and assess exposure
• Apply patches or updates to fix the principal-type-confusion vulnerability
• Monitor for potential cross-account team removal, bot takeover, and roster disclosure attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the principal-type-confusion vulnerability in Vikunja's `web.Auth` interface, which allows link-share principals to be treated as users with matching IDs, potentially leading to unauthorized actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.