Vulnerabilities

Security incident · CVE-2026-76216

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

Published Oct 9, 2026 · catalog updated Oct 27, 2026 · Vikunja: Link-share principal-type confusion

Last checked Oct 28, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-76216. EPSS is 0.36%. Act only if a listed version of Vikunja: Link-share principal-type confusion is installed.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.36%

Remediation

Advisory link

Affected products

Go code.vikunja.io/api

## Summary Vikunja's interface ( , single method ) is satisfied by BOTH and . A link-share's returns the **raw positive** ( ), which lives in the same positive autoincrement ID space as . The safe negated form ( ) exists but is NOT used at three permission sinks. As a result, a link-share principal with id — which should have zero authority over teams or bot users — is treated as the *user* whose at three permission checks that lack the guard their sibling methods have. This is the same principal-type-confusion class as CVE-2026-68581 (GHSA-vvcv-vpph-h844), but at three code paths that advisory/fix never touched. ## Root Cause is a one-method interface ( ). returns the raw positive share id. Three permission methods compare this raw id directly and omit the link-share type guard used elsewhere in the same files: 1. ** ** ( ): the self-removal fast path (:36) executes **before** . (:48-51) is the ONLY place that rejects link shares ( , :50) — and it is never reached when the fast path returns true. 2. ** ** ( ): (:55), used by / / (:36-45). Unlike (:27-30) which type-asserts , these three paths have no principal guard. 3. ** ** ( ): matches membership on (:76) with no link-share guard, unlike sibling (:45-49, guard at :47). Link-share JWTs reach these routes: validates the signature only, returns , and the / route groups add no link-share rejection. Link sharing is enabled by default ( ). ## Impact A link-share principal (obtainable from any public share link, or self-registered via a share on the attacker's own project) whose id collides with a victim's can, without being that user or any user: - **Integrity (I:H):** remove the victim from any team they belong to ( ) → revokes all project permissions the victim inherited through that team. - **Availability/Integrity (A:H, I:H):** enumerate the victim's bot users ( → ), then disable/rename or **permanently delete** them ( → ), destroying data owned solely by those bots. - **Confidentiality (C:H):** read the roster +