GO-2026-6747 Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api

🗓️ 19 Oct 2026 21:08:26Reported by GoogleType

osv_go🔗 osv.dev👁 6 Views

Read-only project members can escalate permissions in Vikunja via the single-share read endpoint.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-91985	9 Oct 202620:51	–	circl
CVE	CVE-2026-91985	15 Sep 202615:18	–	cve
Cvelist	CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash	15 Sep 202615:18	–	cvelist
EUVD	EUVD-2026-78656	9 Oct 202620:51	–	euvd
Github Security Blog	Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level	15 Sep 202618:32	–	github
Github Security Blog	Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level	9 Oct 202620:51	–	github
Mend	CVE-2026-91985	15 Sep 202615:18	–	mend
NVD	CVE-2026-91985	15 Sep 202616:17	–	nvd
osv_ghsa	GHSA-QFWC-VX6F-3G6G Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level	9 Oct 202620:51	–	osv_ghsa
Positive Technologies	PT-2026-118052	19 Oct 202600:00	–	ptsecurity

Source	Link
github	www.github.com/go-vikunja/vikunja/security/advisories/GHSA-qfwc-vx6f-3g6g
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-91985
github	www.github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2
github	www.github.com/go-vikunja/vikunja/pull/3688
github	www.github.com/go-vikunja/vikunja/releases/tag/v2.6.0
vulncheck	www.vulncheck.com/advisories/vikunja-before-2.6.0-privilege-escalation-via-link-share-hash

19 Oct 2026 21:31Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

CVSS 48.7

EPSS0.00432

SSVC