CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Attackers with link-share JWTs can exploit ID collisions to remove team members, delete bots, or read rosters in Vikunja.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76216?
CVE-2026-76216 is a high-severity authentication bypass vulnerability in go-vikunja vikunja, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Weakness: CWE-639
Which versions are affected by CVE-2026-76216?
3 open source packages ship an affected version, including code.vikunja.io/api.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | All versions | 2.5.0 |
code.vikunja.io/api Go | All versions | 2.5.0 |
How do I fix CVE-2026-76216?
Upgrade code.vikunja.io/api to 2.5.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-76216 being exploited?
There is no known exploitation of CVE-2026-76216 in the wild and no public exploit code.
Sources
Also known as GHSA-32r8-5843-4qw2, GO-2026-6711.