In Vikunja versions 0.22.0 through 2.3.0, the API token management endpoints do not correctly validate the principal type. User IDs and link-share IDs are independent numeric sequences but both resolve through a generic interface. If a link-share JWT's numeric ID equals a target user's ID, the system treats the JWT as if it belongs to that user. An authenticated attacker can discover a target user's numeric ID via user search, then create link shares until the link-share sequence reaches that ID. Using the resulting link-share JWT, the attacker can list, create, delete, and issue API tokens under the target user's permissions. This flaw allows privilege escalation within the API token management context. The issue is resolved in version 2.4.0.

An authenticated attacker can impersonate a target user in the API token management endpoints by exploiting the flawed principal type validation. This allows the attacker to manage the target user's API tokens, including issuing new tokens with arbitrary scopes, potentially leading to unauthorized access and actions under the target user's identity. The vulnerability has a high severity with a CVSS 4.0 score of 8.6.

Upgrade to Vikunja version 2.4.0 or later, where this authorization flaw is fixed. No other official remediation or temporary workaround is indicated. Patch status is not explicitly stated but the fix version is known.