CVE-2026-76216— Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Quick assessment
Affected
go-vikunja vikunja
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vikunja 2.4.0 及更早版本存在一种主体类型混淆漏洞。在该漏洞中，来自链接共享（LinkSharing）的主体（principal）其 id 为 N 时，会被系统当作 id 为 N 的用户主体来处理，涉及三个权限检查点，但缺少类型保护机制（type guards）。拥有链接共享 JWT（JSON Web Token）的攻击者可以利用自增 ID 空间中的 ID 冲突，执行以下操作：将受害者从团队中移除、枚举并删除受害者的机器人用户，或读取团队成员列表。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access TokenAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| go-vikunja | vikunja | ≤ 2.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76216
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| go-vikunja | vikunja | 0 ~ 2.4.0 | - |
|
II. Public POCs for CVE-2026-76216
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 8631 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-76216
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76216 (2)
IV. Related Vulnerabilities
Same product: vikunja
-
CVE-2026-68582
Vikunja 0.24.0 Broken Object Level Authorization via Link-Sh -
CVE-2026-68581
Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Princ -
CVE-2026-56765
Vikunja - Unauthenticated Instance-Wide Data Breach via Link -
CVE-2026-40103
Vikunja's Scoped API tokens with projects.background permiss -
CVE-2026-35602
Vikunja has a File Size Limit Bypass via Vikunja Import
Same vendor: go-vikunja
-
CVE-2026-68582
Vikunja 0.24.0 Broken Object Level Authorization via Link-Sh -
CVE-2026-68581
Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Princ -
CVE-2026-40103
Vikunja's Scoped API tokens with projects.background permiss -
CVE-2026-35602
Vikunja has a File Size Limit Bypass via Vikunja Import -
CVE-2026-35601
Vikunja has an iCalendar Property Injection via CRLF in CalD
Same weakness: CWE-639
-
CVE-2026-78203
Ghostwriter before 7.1.2 Cross-Client Report Template Disclo -
CVE-2026-78160
Dolibarr ERP User Notes note.php authorization -
CVE-2026-78144
code-projects Barangay Resident Profiling Management System -
CVE-2026-78142
code-projects Barangay Resident Profiling Management System -
CVE-2026-62283
Nezha Monitoring: Cross-tenant terminal/file-manager session
V. Comments for CVE-2026-76216
No comments yet