CVE-2026-57458

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.

Summary

A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials.

A token limited to:

{"oauth":["authorize"]}

can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obtain a normal bearer JWT plus refresh token. The resulting credentials are not restricted by the original API-token permissions.

Affected Component

• Scoped API tokens
• OAuth authorization flow
• POST /api/v1/oauth/authorize
• POST /api/v1/oauth/token

Impact

A narrowly scoped API token with only oauth.authorize can be converted into normal session credentials for the same user.

This bypasses the intended API-token permission boundary. An attacker who obtains or is delegated such a limited token can mint a normal JWT and refresh token, then access routes outside the original token scope.

Runtime validation showed that the original scoped token could not access GET /api/v1/user, but the minted OAuth access token could access:

• GET /api/v1/user
• GET /api/v1/projects

No cross-user access, privilege escalation to admin, or access to another account was validated.

Technical Details

The issue is caused by an authentication-context mismatch between scoped API-token authentication and OAuth authorization-code issuance.

The vulnerable chain is:

1. A scoped API token authenticates the request and sets the current user context.
2. /api/v1/oauth/authorize accepts that API-token-authenticated user as a valid OAuth resource owner.
3. The OAuth authorization endpoint issues an authorization code.
4. /api/v1/oauth/token exchanges that code for a normal bearer JWT and refresh token.
5. The resulting credentials are not bound to the original API-token permissions.

Relevant code paths:

• pkg/routes/routes.go

  • registers /api/v1/oauth/authorize in an authenticated API route group that also accepts scoped API tokens

• pkg/models/api_routes.go

  • exposes non-CRUD subroutes as API-token permissions
  • exposes the OAuth authorization endpoint under the oauth permission group

• pkg/routes/api_tokens.go

  • stores api_token and api_user in the request context during API-token authentication

• pkg/user/user.go

  • treats api_user as an authenticated current user

• pkg/modules/auth/oauth2server/authorize.go

  • uses the current user and issues an OAuth authorization code

• pkg/modules/auth/oauth2server/token.go

  • exchanges the authorization code for a normal JWT and refresh token

Steps to Reproduce

1. Create a scoped API token

Create an API token with only the following permission:

{"oauth":["authorize"]}

Observed response:

201 Created

The returned token had only the oauth.authorize permission.

2. Negative control: direct access with scoped token fails

Request:

GET /api/v1/user
Authorization: Bearer <scoped-api-token>

Observed response:

401 Unauthorized

Response body:

{"code":11,"message":"missing, malformed, expired or otherwise invalid token provided"}

This confirms that the scoped token cannot directly access the normal user route.

3. Obtain an OAuth authorization code with the scoped token

Request:

POST /api/v1/oauth/authorize
Authorization: Bearer <scoped-api-token>
Content-Type: application/json

Body:

{
  "response_type": "code",
  "client_id": "vikunja",
  "redirect_uri": "vikunja-flutter://callback",
  "code_challenge": "<pkce-s256-challenge>",
  "code_challenge_method": "S256"
}

Observed response:

200 OK

Response body:

{
  "code": "<redacted>",
  "redirect_uri": "vikunja-flutter://callback",
  "state": ""
}

The scoped API token successfully obtained an OAuth authorization code.

4. Exchange the authorization code for session credentials

Request:

POST /api/v1/oauth/token
Content-Type:…

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.

Summary

A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials.

A token limited to:

{"oauth":["authorize"]}

can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obtain a normal bearer JWT plus refresh token. The resulting credentials are not restricted by the original API-token permissions.

Affected Component

• Scoped API tokens
• OAuth authorization flow
• POST /api/v1/oauth/authorize
• POST /api/v1/oauth/token

Impact

A narrowly scoped API token with only oauth.authorize can be converted into normal session credentials for the same user.

This bypasses the intended API-token permission boundary. An attacker who obtains or is delegated such a limited token can mint a normal JWT and refresh token, then access routes outside the original token scope.

Runtime validation showed that the original scoped token could not access GET /api/v1/user, but the minted OAuth access token could access:

• GET /api/v1/user
• GET /api/v1/projects

No cross-user access, privilege escalation to admin, or access to another account was validated.

Technical Details

The issue is caused by an authentication-context mismatch between scoped API-token authentication and OAuth authorization-code issuance.

The vulnerable chain is:

1. A scoped API token authenticates the request and sets the current user context.
2. /api/v1/oauth/authorize accepts that API-token-authenticated user as a valid OAuth resource owner.
3. The OAuth authorization endpoint issues an authorization code.
4. /api/v1/oauth/token exchanges that code for a normal bearer JWT and refresh token.
5. The resulting credentials are not bound to the original API-token permissions.

Relevant code paths:

• pkg/routes/routes.go

  • registers /api/v1/oauth/authorize in an authenticated API route group that also accepts scoped API tokens

• pkg/models/api_routes.go

  • exposes non-CRUD subroutes as API-token permissions
  • exposes the OAuth authorization endpoint under the oauth permission group

• pkg/routes/api_tokens.go

  • stores api_token and api_user in the request context during API-token authentication

• pkg/user/user.go

  • treats api_user as an authenticated current user

• pkg/modules/auth/oauth2server/authorize.go

  • uses the current user and issues an OAuth authorization code

• pkg/modules/auth/oauth2server/token.go

  • exchanges the authorization code for a normal JWT and refresh token

Steps to Reproduce

1. Create a scoped API token

Create an API token with only the following permission:

{"oauth":["authorize"]}

Observed response:

201 Created

The returned token had only the oauth.authorize permission.

2. Negative control: direct access with scoped token fails

Request:

GET /api/v1/user
Authorization: Bearer <scoped-api-token>

Observed response:

401 Unauthorized

Response body:

{"code":11,"message":"missing, malformed, expired or otherwise invalid token provided"}

This confirms that the scoped token cannot directly access the normal user route.

3. Obtain an OAuth authorization code with the scoped token

Request:

POST /api/v1/oauth/authorize
Authorization: Bearer <scoped-api-token>
Content-Type: application/json

Body:

{
  "response_type": "code",
  "client_id": "vikunja",
  "redirect_uri": "vikunja-flutter://callback",
  "code_challenge": "<pkce-s256-challenge>",
  "code_challenge_method": "S256"
}

Observed response:

200 OK

Response body:

{
  "code": "<redacted>",
  "redirect_uri": "vikunja-flutter://callback",
  "state": ""
}

The scoped API token successfully obtained an OAuth authorization code.

4. Exchange the authorization code for session credentials

Request:

POST /api/v1/oauth/token
Content-Type:…

Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api from v2.3.0 before v2.4.0.