PT-2026-109320

Name of the Vulnerable Software and Affected Versions Vikunja version 2.3.0 Description An authentication-context mismatch allows a scoped API token limited to the oauth.authorize permission to bypass its declared restrictions. By calling the 'POST /api/v1/oauth/authorize' endpoint, an attacker c...