CVE-2026-111922: Permissive Cross-domain Security Policy with Untrusted Domains in go-vikunja vikunja

The vulnerability in Vikunja (versions >=2.2.0 <2.7.0) involves an overly permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, regardless of the service.publicurl setting. This allows attackers who can run code on any localhost port to send credentialed requests to the token refresh endpoint and read the returned bearer JWT token. With this token, attackers can impersonate the logged-in user and take over their account. The CVSS 4.0 score is 7.2, indicating a high-severity issue with local attack vector, low attack complexity, and partial user interaction required.

An attacker with control over a page on any localhost port can exploit this vulnerability to obtain the victim's bearer JWT token by sending credentialed requests to the token refresh endpoint. This enables account takeover of the logged-in user, compromising user confidentiality and integrity within the affected Vikunja application.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running untrusted code on localhost ports or restrict access to localhost interfaces. Monitor vendor channels for updates addressing this permissive CORS configuration.