CVE-2026-91985

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0

Description Insufficient access restriction to the link-share hash field in single-share read endpoints allows read-only members to obtain the secret credential of a share. An attacker can use this disclosed hash to obtain a link-share JWT (JSON Web Token), which is a compact, URL-safe means of representing claims to be transferred between two parties. This allows the attacker to escalate privileges and perform unauthorized administrative actions or writes.

Recommendations Update to version 2.6.0 or later.