Medium severity · published Sep 15, 2026
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
vikunja · go-vikunja
1.0.0 before 2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91983
github.com
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rg3-v78m-26q8
www.vulncheck.com
https://www.vulncheck.com/advisories/vikunja-before-2.6.0-api-token-scope-bypass-via-expand-parameter
More from vikunja
9.8
CVE-2026-28268
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
9.6
CVE-2026-33334
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
9.1
CVE-2026-34727
Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
9.1
CVE-2026-27575
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
8.8
CVE-2026-33336
Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation