CVE-2026-111922

Name of the Vulnerable Software and Affected Versions Vikunja versions 2.2.0 through 2.6.9

Description The software has a permissive Cross-Origin Resource Sharing (CORS) configuration that trusts all ports on localhost and 127.0.0.1 with credentials, regardless of the service.publicurl setting. This allows an attacker controlling a page on any localhost port to send a credentialed request to the token refresh endpoint and retrieve the bearer JSON Web Token (JWT), which is a compact, URL-safe means of representing claims to be transferred between two parties, leading to full account takeover of the logged-in user.

Recommendations Update Vikunja to version 2.7.0 or later.