2 matches found
CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...
7.7CVSS5.4AI score
SaveExploits0References4
PT-2026-78398
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...
7.5CVSS5.2AI score0.00264EPSS
SaveExploits0References3
20