Description

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T14:17:47.743Z",
  "pubdate": "2026-08-19T14:17:47.743Z",
  "executiveSummary": "Vikunja through 2.4.0 suffers from a principal-type confusion vulnerability that arises due to inadequate type guards during specific authorization checks. The flaw affects Vikunja versions up to 2.4.0, impacting system integrity, data confidentiality, and access control mechanisms. The root of the issue lies in how permission verification logic handles principal identifiers, specifically treating LinkSharing principals with an identifier N as user principals where users.id equals N. This oversight allows threat actors possessing a link-share JSON Web Token (JWT) to leverage autoincrement ID collisions to execute unauthorized actions against targeted users and teams. The attacker capabilities include removing victims from teams, enumerating and deleting victim bot users, and reading sensitive team rosters. Exploitation requires the attacker to obtain a valid link-share JWT and exploit the predictable nature or overlapping values of the autoincrement primary key space. The risk implications are severe, as unauthorized principal resolution undermines the security boundaries between distinct permission contexts, potentially leading to unauthorized administrative modifications and data exposure within the affected collaborative workspace environment.",
  "technicalDetails": "The vulnerability is localized within the permission-checking subsystems of Vikunja through 2.4.0, specifically across three distinct permission verification routines that process incoming principal references without verifying their underlying types. In the application's access control model, distinct entities such as user principals and LinkSharing principals share numeric identifier spaces managed via database autoincrement mechanisms. A principal-type confusion condition occurs because the authorization logic assumes that an identifier N associated with a LinkSharing principal uniquely maps to a user principal whenever users.id equals N, lacking explicit type guards to differentiate between the principal categories. To exploit this flaw, an attacker must first acquire a link-share JWT, which grants initial access to the shared resource context. By leveraging the autoincrement ID collision space where a LinkSharing principal ID numerically matches a target user ID, the attacker crafts or manipulates requests to bypass contextual boundaries. When the application executes the vulnerable permission checks without validating the principal type, the security context evaluates the link-share identifier as a valid user principal ID. Consequently, the attacker can manipulate victim memberships within teams, systematically enumerate and delete victim bot users due to elevated or misrouted permissions, and read confidential team rosters. The attack flow relies entirely on the absence of strict type assertions in the authorization checks, transforming a low-privilege link-sharing context into unauthorized user-level administrative control over intersecting resource identifiers. The affected component involves the backend authorization and permission resolution handlers responsible for evaluating principal permissions against target entities in versions up to 2.4.0."
}