CVE-2026-76216: Authorization Bypass Through User-Controlled Key in go-vikunja vikunja

Vikunja versions up to and including 2.4.0 contain a principal-type confusion vulnerability. Specifically, LinkSharing principals with an ID N are treated as user principals with users.id == N in three permission checks that lack proper type guards. This misclassification enables attackers holding a link-share JWT to bypass authorization controls, allowing them to remove users from teams, enumerate and delete bot users, and access team rosters by exploiting collisions in the autoincrement ID space.

Exploitation of this vulnerability allows attackers with a link-share JWT to bypass authorization mechanisms, leading to unauthorized removal of users from teams, enumeration and deletion of bot users, and unauthorized reading of team rosters. This compromises the integrity and confidentiality of team membership and bot user data within affected Vikunja instances.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to link-share JWTs and monitor for suspicious activity related to team membership and bot user management.