Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Vikunja versions 0.22.0 through 2.3.0 do not properly validate the principal type in API token management endpoints. User IDs and link-share IDs are independent numeric sequences but both resolve through a generic interface. If a link-share JWT's numeric ID matches a target user's ID, the system treats the JWT as belonging to that user. An authenticated attacker can discover a target user's numeric ID, create link shares until the link-share ID matches that user ID, then use the resulting JWT to list, create, and delete the target user's API tokens, including issuing new tokens with attacker-chosen scopes under the target's permissions. This vulnerability is fixed in Vikunja version 2.4.0.

An authenticated attacker can impersonate another user by exploiting the principal ID collision, allowing them to manage the victim's API tokens. This includes listing, creating, deleting tokens, and issuing new tokens with arbitrary scopes under the victim's permissions. This leads to a complete compromise of the victim's API access without needing the victim's credentials.

Upgrade Vikunja to version 2.4.0 or later, where this vulnerability has been fixed. No other mitigations are specified. Patch status is confirmed fixed in 2.4.0.