CVE-2026-111922 Vikunja CVE debrief

Who should care

Defenders responsible for Vikunja deployments, especially those where user account security is crucial, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and remediate this vulnerability to prevent account takeovers through credentialed requests to the token refresh endpoint.

Why it matters

CVE-2026-111922 is a high-severity vulnerability in Vikunja that allows attackers to take over user accounts due to a permissive CORS configuration. Defenders should prioritize verifying and remediating this vulnerability, especially in deployments where user account security is crucial. The vulnerability affects versions 2.2.0 to 2.7.0, and its exploitation requires control of a localhost port. Evidence is limited, and further verification is needed to determine the full scope of affected systems and potential impact.

• Account takeover through credentialed requests to the token refresh endpoint.
• Potential for unauthorized access to sensitive information.
• Need for verification of Vikunja version and CORS configuration.
• Priority for updating Vikunja to a secure version.

Technical summary

The CVE-2026-111922 vulnerability in Vikunja is caused by a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials. This allows attackers controlling a page on any localhost port to send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account. The vulnerability affects Vikunja versions from 2.2.0 before 2.7.0.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in deployments where user account security is crucial.

Recommended defensive actions

• Verify the version of Vikunja in use and check if it falls within the affected range (2.2.0 to 2.7.0).
• Update Vikunja to version 2.7.0 or later to remediate the vulnerability.
• Review and restrict CORS configurations to only allow trusted origins.
• Monitor for any suspicious activity related to credentialed requests to the token refresh endpoint.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, additional information on exploitation or victim impact is limited. Defenders should verify the version of Vikunja in use, check if it falls within the affected range (2.2.0 to 2.7.0), and review CORS configurations to only allow trusted origins. Evidence is limited, and further verification is needed to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.