Vikunja versions 0.22.0 through 2.3.0 improperly validate principal types in API token management endpoints. Because user IDs and link-share IDs are independent numeric sequences but both resolve through a generic interface, a link-share JWT whose numeric ID matches a target user's ID is mistakenly treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can discover a target user's numeric ID, generate link shares until the link-share ID matches that user ID, then use the resulting link-share JWT to manage the target user's API tokens, including issuing new tokens with attacker-controlled scopes. This allows unauthorized token management under the target user's permissions. The issue is resolved in version 2.4.0.

An authenticated attacker can escalate privileges by managing API tokens of arbitrary users whose numeric IDs they can discover. This includes listing, creating, deleting, and issuing new API tokens with attacker-chosen scopes under the target user's permissions, potentially leading to unauthorized access and actions within the system. The vulnerability affects all versions from 0.22.0 up to and including 2.3.0.

Upgrade to Vikunja version 2.4.0 or later, where this authorization flaw is fixed. Patch status is not explicitly stated, but the fix is included in version 2.4.0. Until upgrading, restrict authenticated user capabilities to prevent attackers from enumerating user IDs or creating link shares arbitrarily. Monitor for suspicious API token management activity. No vendor advisory is provided to indicate alternative mitigations or that no action is required.