CVE-2026-76216 is a principal-type confusion vulnerability in Vikunja through version 2.4.0. The vulnerability occurs because LinkSharing principals identified by an ID N are incorrectly treated as user principals with users.id == N in three permission checks that do not enforce type guards. This allows an attacker possessing a link-share JWT to exploit ID collisions in the autoincrement space, enabling unauthorized actions such as removing victims from teams, enumerating and deleting victim bot users, and reading team rosters.

An attacker with a link-share JWT can bypass authorization controls to perform unauthorized actions including removing legitimate users from teams, enumerating and deleting bot users associated with victims, and accessing team rosters. This compromises team membership integrity and confidentiality of team information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.