CVE-2026-91983 describes an authorization bypass vulnerability in go-vikunja's vikunja product prior to version 2.6.0. The vulnerability occurs because the API token scope enforcement fails to properly inspect query string parameters in task read endpoints. Specifically, attackers with limited token scopes can exploit the expand parameter to retrieve sensitive data like comments, reactions, and time entries that should be restricted. This improper authorization check allows unauthorized data access.

Attackers with limited API token scopes can bypass intended access restrictions and retrieve sensitive task-related data such as comments, reactions, and time entries. This could lead to unauthorized disclosure of potentially sensitive information. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required beyond limited token scope, no user interaction, and low impact on confidentiality.

Upgrade vikunja to version 2.6.0 or later where this authorization bypass vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the affectedVersions field indicating versions before 2.6.0 are vulnerable.