Go Vikunja: Twelve Vulnerabilities Including Privilege Escalation and Auth Bypass Disclosed Together
Twelve vulnerabilities affecting Go Vikunja, including privilege escalation and authentication bypass, were disclosed and patched in version 2.6.0.
Key findings
- Twelve vulnerabilities disclosed for Go Vikunja, patched in version 2.6.0.
- High-severity flaws include privilege escalation via link-share tokens and authentication bypass via CalDAV.
- Multiple vulnerabilities exploit insufficient rate limiting on authentication and API endpoints.
- Resource exhaustion risks include DoS via large file decompression and crafted image uploads.
- Users with read-only access can potentially enumerate users and escalate privileges.
- All disclosed vulnerabilities were fixed in a single release, version 2.6.0.
On September 15, 2026, a batch of twelve vulnerabilities was disclosed for Go Vikunja, a self-hosted open-source task management application. These vulnerabilities, all patched in version 2.6.0, span a range of security weaknesses including privilege escalation, authentication bypass, and resource exhaustion. The disclosures highlight several areas where access controls and input validation were insufficient, potentially allowing authenticated and unauthenticated attackers to compromise user data and system stability.
Several vulnerabilities center on insufficient access control and privilege escalation. CVE-2026-91985, a high-severity flaw, allows read-only members to obtain a share's secret credential by exploiting improper access restrictions in link-share endpoints. This credential can then be exchanged for a link-share JWT, enabling privilege escalation. Similarly, CVE-2026-91983 describes an API token scope bypass in task read endpoints where attackers can use the 'expand' parameter to access restricted data like comments and time entries without proper verification. CVE-2026-91981 also involves link-share tokens, where attackers with read-only access can enumerate project users and confirm arbitrary usernames via specific API endpoints. CVE-2026-91980 allows authenticated users to enumerate all teams and members by failing to validate team access when attaching teams to projects, enabling the retrieval of complete team rosters.
Authentication and brute-force protection were also found to be lacking in multiple instances. CVE-2026-91973, a high-severity vulnerability, involves an authentication bypass in CalDAV BasicAuth endpoints due to a lack of rate limiting, allowing unauthenticated attackers to perform unbounded credential guessing. CVE-2026-91972, another high-severity issue, reveals that public authentication endpoints, including login, registration, and password reset routes, lack rate limiting. This enables unauthenticated attackers to perform credential guessing, account enumeration, and password reset flooding attacks. Furthermore, CVE-2026-91984 allows authenticated attackers to insert task position rows into arbitrary project views by failing to validate that a user-supplied project_view_id belongs to the task's project. CVE-2026-91982 exposes the raw TOTP shared secret after enrollment through specific endpoints without requiring re-authentication, allowing attackers with a valid access token to import the secret and bypass two-factor authentication.
Resource exhaustion vulnerabilities present a significant risk to Vikunja instances. CVE-2026-91979 allows authenticated users to cause a denial of service by uploading highly compressed files that expand to consume excessive memory and disk space during data import. CVE-2026-91970 enables authenticated users to consume significant CPU and memory by uploading crafted images with extreme aspect ratios to avatar and project-background upload endpoints, bypassing pixel decode limits. CVE-2026-91971 involves the Planka migrator, where a failure to enforce aggregate memory budgets during migration jobs allows authenticated attackers to exhaust server resources by pointing to attacker-controlled servers with numerous attachments. Finally, CVE-2026-91969 allows authenticated attackers to terminate the API service by uploading CSV files with millions of records to the CSV migration endpoint, which fails to limit parsed row cardinality.
All twelve vulnerabilities were addressed in Vikunja version 2.6.0. Users are strongly advised to update to this version to mitigate these security risks. The batch of disclosures underscores the importance of rigorous input validation, robust access control mechanisms, and effective rate limiting across all API endpoints, particularly those handling authentication, file uploads, and data imports.
The coordinated disclosure of these twelve vulnerabilities on September 15, 2026, highlights critical security weaknesses within Vikunja versions prior to 2.6.0. The range of issues, from privilege escalation to denial-of-service attacks, emphasizes the need for users to promptly apply the available security update. Proactive security practices, including regular updates and security audits, are essential for maintaining the integrity and confidentiality of data managed by Vikunja instances.