Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Executive Summary Vikunja accepts both regular-user JSON Web Tokens JWTs and link-share JWTs through its generic authenticated API route group. A link-share JWT resolves to a models.LinkSharing principal whose GetID method returns the numeric linkshares.id. The API-token management model then...

Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vvcv-vpph-h844. This link is maintained to preserve external references. Original Description Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs a...

GHSA-9JRX-VMH8-C6XW Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vvcv-vpph-h844. This link is maintained to preserve external references. Original Description Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs a...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581: Incorrect Authorization

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2025-64706: Authorization Bypass Through User-Controlled Key

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference IDOR vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing th...

CVE-2025-4646

Incorrect Authorization vulnerability in Centreon web API Token creation form modules allows Privilege Escalation.This issue affects web: from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4...

GHSA-5PM7-CP8F-P2C2 wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery CSRF vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing...