CVE-2026-57458

Name of the Vulnerable Software and Affected Versions Vikunja version 2.3.0

Description An authentication-context mismatch allows a scoped API token limited to the oauth.authorize permission to bypass its declared restrictions. By calling the 'POST /api/v1/oauth/authorize' endpoint, an attacker can obtain an OAuth authorization code and subsequently exchange it at the 'POST /api/v1/oauth/token' endpoint for a standard bearer JSON Web Token (JWT) and refresh token. These resulting credentials are not bound by the original API token's permissions, granting unauthorized access to routes outside the original scope for the same user, such as 'GET /api/v1/user' and 'GET /api/v1/projects'.

Recommendations Update Vikunja to version 2.4.0.