CVE-2026-91985: Exposure of Sensitive Information to an Unauthorized Actor in go-vikunja vikunja
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.
AI Analysis
Technical Summary
CVE-2026-91985 affects Vikunja before version 2.6.0. The vulnerability arises because the application fails to properly restrict access to the link-share hash field in single-share read endpoints. Read-only members can retrieve this secret hash, which can then be exchanged for a link-share JWT token at the share's permission level. This token can be used to escalate privileges, allowing unauthorized write or administrative operations on the share.
Potential Impact
An attacker with read-only access can obtain secret credentials that allow them to escalate privileges to write or administrative levels. This can lead to unauthorized modification or control over shared resources within Vikunja, potentially compromising data integrity and confidentiality.
Mitigation Recommendations
A fix is available in Vikunja version 2.6.0. Users should upgrade to version 2.6.0 or later to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.
CVE-2026-91985: Exposure of Sensitive Information to an Unauthorized Actor in go-vikunja vikunja
Description
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.
CVSS v4.0
Score 8.7high
Affected software
go-vikunja
vikunja
pkg:golang/github.com/go-vikunja/vikunjaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-91985 affects Vikunja before version 2.6.0. The vulnerability arises because the application fails to properly restrict access to the link-share hash field in single-share read endpoints. Read-only members can retrieve this secret hash, which can then be exchanged for a link-share JWT token at the share's permission level. This token can be used to escalate privileges, allowing unauthorized write or administrative operations on the share.
Potential Impact
An attacker with read-only access can obtain secret credentials that allow them to escalate privileges to write or administrative levels. This can lead to unauthorized modification or control over shared resources within Vikunja, potentially compromising data integrity and confidentiality.
Mitigation Recommendations
A fix is available in Vikunja version 2.6.0. Users should upgrade to version 2.6.0 or later to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-15T11:10:41.354Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa9651e55bf5e2cf502eb31
Added to database: 09/15/2026, 15:32:46 UTC
Last enriched: 09/15/2026, 15:46:49 UTC
Last updated: 09/16/2026, 04:01:32 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.