CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
Read-only members can obtain link-share secrets to escalate privileges and perform unauthorized writes or administrative actions in Vikunja.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91985?
CVE-2026-91985 is a high-severity vulnerability in go-vikunja vikunja, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.
Weakness: CWE-200
Which versions are affected by CVE-2026-91985?
3 open source packages ship an affected version, including code.vikunja.io/api.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | All versions | 2.6.0 |
code.vikunja.io/api Go | All versions | 2.6.0 |
How do I fix CVE-2026-91985?
Upgrade code.vikunja.io/api to 2.6.0 or later.
Is CVE-2026-91985 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91985 exists.
Sources
Also known as GHSA-qfwc-vx6f-3g6g, GO-2026-6747.