{"id":"CVE-2026-91983","aliases":["EUVD-2026-78654","GHSA-9rg3-v78m-26q8","GHSA-phph-c358-5mwm","GO-2026-6726"],"status":"published","title":"Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter","description":"Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00305,"percentile":0.23446,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-09-15T15:18:26Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Go","package":"code.vikunja.io/api","fixed_in":["2.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"code.vikunja.io/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"2.5.0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"go-vikunja","product":"vikunja"}],"references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9rg3-v78m-26q8","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/vikunja-before-2.6.0-api-token-scope-bypass-via-expand-parameter","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91983","tags":["advisory"]},{"url":"https://github.com/go-vikunja/vikunja/pull/3688","tags":["web"]},{"url":"https://github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2","tags":["web"]},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9rg3-v78m-26q8"},{"url":"https://github.com/advisories/GHSA-phph-c358-5mwm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91983.json","tags":["advisory"]},{"url":"https://github.com/go-vikunja/vikunja","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-91983","title":"Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter","description":"Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.","status":"published","published":"2026-09-15T15:18:26.899Z","modified":"2026-09-15T15:52:07.941Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:53.115938Z"}],"euvd":[{"id":"EUVD-2026-78654","description":"Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.","status":"published","published":"2026-09-15T15:18:26Z","modified":"2026-09-15T15:52:07Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:28:17.768191Z"}],"ghsa":[{"id":"GHSA-9rg3-v78m-26q8","title":"Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)","description":"## Summary\n\nAPI token permission checks only match the HTTP method and route path. The `expand` query parameter on task read endpoints embeds data from other permission groups (task comments, reactions, time entry counts) without checking whether the token holds those scopes. A token scoped only to `tasks` read permissions can therefore read task comments and reactions it was explicitly not granted.\n\n## Details\n\n`models.CanDoAPIRoute` (`pkg/models/api_routes.go`, ~line 440) authorises API tokens purely by comparing `method` and `c.Path()` against the routes stored for each granted permission group. The query string is never consulted.\n\nThe task read endpoints accept `expand`:\n\n- `GET /api/v1/tasks/:task`, `GET /api/v1/tasks` (`pkg/models/tasks.go` ReadOne/ReadAll, `pkg/models/task_collection.go`)\n- `GET /api/v2/tasks/:id`, `GET /api/v2/tasks`, `GET /api/v2/projects/:project/tasks` (`pkg/routes/api/v2/tasks.go`, `task_collection.go`)\n\nAccepted values include `comments`, `comment_count`, `reactions`, `time_entries_count`. `addMoreInfoToTasks` (`pkg/models/tasks.go`, ~line 683) loads and embeds that data. At that layer only a `web.Auth` (the plain owner user, resolved by `auth.GetAuthFromClaims`) is available, so the token's scopes cannot be enforced there either.\n\nResult: the `tasks_comments`, `reactions`, and `time_entries` permission groups are advisory for any data reachable through a task expansion.\n\n## Impact\n\nA holder of an API token scoped to `tasks: [read_one]` or `tasks: [read_all]` (or `projects_views_tasks: [read_all]`) can read the full bodies of task comments, all reactions, and time entry counts on every task the token owner can access, despite `GET /api/v1|v2/tasks/:task/comments` and the reactions endpoints correctly returning 401 for the same token.\n\nThe leak is limited to data the token owner can already see, and is read-only. The realistic victim is a user who grants a narrowly scoped token to a third-party integration expecting comments to stay private.\n\n## Proof of Concept\n\nAgainst the test fixtures (`pkg/db/fixtures/api_tokens.yml`, token 1 has `{\"tasks\":[\"read_all\",\"update\"]}`, plaintext `tk_2eef46f40ebab3304919ab2e7e39993f75f29d2e`):\n\n```\nGET /api/v2/tasks/1/comments\nAuthorization: Bearer tk_2eef46f40ebab3304919ab2e7e39993f75f29d2e\n-\u003e 401 {\"code\":11,\"message\":\"missing, malformed, expired or otherwise invalid token provided\"}\n\nGET /api/v2/tasks?expand=comments\u0026filter=id%3D1\nAuthorization: Bearer tk_2eef46f40ebab3304919ab2e7e39993f75f29d2e\n-\u003e 200, response items[0].comments contains the full comment objects\n```\n\nSame behaviour with `expand=reactions`, and on the v1 endpoints `GET /api/v1/tasks?expand=comments` / `GET /api/v1/tasks/1?expand=comments`. Any user-created token with only `tasks` read permissions reproduces this.\n\n## Recommended Fix\n\nEnforce expansions in the single existing choke point, `models.CanDoAPIRoute`: after the method/path match succeeds, read `c.QueryParams()[\"expand\"]` and require the token to hold the owning group's read permission for each value, e.g.\n\n- `comments`, `comment_count` -\u003e `tasks_comments.read_all`\n- `reactions` -\u003e `reactions.read_all`\n- `time_entries_count` -\u003e `time_entries.read_all`\n\n(`subtasks`, `buckets`, `is_unread` are task-level data and need nothing extra.) Doing this in the middleware covers both v1 and v2 without handler or model changes. Add a table-driven test alongside `pkg/webtests/api_token_method_matching_test.go` asserting a `tasks`-only token gets 401 with `expand=comments` and 200 once `tasks_comments.read_all` is added.","status":"published","published":"2026-10-09T20:51:52Z","modified":"2026-10-09T20:51:53Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:31.175024Z"},{"id":"GHSA-phph-c358-5mwm","title":"Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9rg3-v78m-26q8. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.","status":"withdrawn","published":"2026-09-15T18:32:30Z","modified":"2026-10-09T20:51:47Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:31.175024Z"}],"nvd":[{"id":"CVE-2026-91983","description":"Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.","status":"published","published":"2026-09-15T16:17:55.373Z","modified":"2026-09-16T20:16:09.343Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-91983","title":"Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter","description":"Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.","status":"published","published":"2026-09-15T15:18:26.899Z","modified":"2026-10-28T02:30:39.551876839Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"GHSA-9rg3-v78m-26q8","title":"Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)","description":"## Summary\n\nAPI token permission checks only match the HTTP method and route path. The `expand` query parameter on task read endpoints embeds data from other permission groups (task comments, reactions, time entry counts) without checking whether the token holds those scopes. A token scoped only to `tasks` read permissions can therefore read task comments and reactions it was explicitly not granted.\n\n## Details\n\n`models.CanDoAPIRoute` (`pkg/models/api_routes.go`, ~line 440) authorises API tokens purely by comparing `method` and `c.Path()` against the routes stored for each granted permission group. The query string is never consulted.\n\nThe task read endpoints accept `expand`:\n\n- `GET /api/v1/tasks/:task`, `GET /api/v1/tasks` (`pkg/models/tasks.go` ReadOne/ReadAll, `pkg/models/task_collection.go`)\n- `GET /api/v2/tasks/:id`, `GET /api/v2/tasks`, `GET /api/v2/projects/:project/tasks` (`pkg/routes/api/v2/tasks.go`, `task_collection.go`)\n\nAccepted values include `comments`, `comment_count`, `reactions`, `time_entries_count`. `addMoreInfoToTasks` (`pkg/models/tasks.go`, ~line 683) loads and embeds that data. At that layer only a `web.Auth` (the plain owner user, resolved by `auth.GetAuthFromClaims`) is available, so the token's scopes cannot be enforced there either.\n\nResult: the `tasks_comments`, `reactions`, and `time_entries` permission groups are advisory for any data reachable through a task expansion.\n\n## Impact\n\nA holder of an API token scoped to `tasks: [read_one]` or `tasks: [read_all]` (or `projects_views_tasks: [read_all]`) can read the full bodies of task comments, all reactions, and time entry counts on every task the token owner can access, despite `GET /api/v1|v2/tasks/:task/comments` and the reactions endpoints correctly returning 401 for the same token.\n\nThe leak is limited to data the token owner can already see, and is read-only. The realistic victim is a user who grants a narrowly scoped token to a third-party integration expecting comments to stay private.\n\n## Proof of Concept\n\nAgainst the test fixtures (`pkg/db/fixtures/api_tokens.yml`, token 1 has `{\"tasks\":[\"read_all\",\"update\"]}`, plaintext `tk_2eef46f40ebab3304919ab2e7e39993f75f29d2e`):\n\n```\nGET /api/v2/tasks/1/comments\nAuthorization: Bearer tk_2eef46f40ebab3304919ab2e7e39993f75f29d2e\n-\u003e 401 {\"code\":11,\"message\":\"missing, malformed, expired or otherwise invalid token provided\"}\n\nGET /api/v2/tasks?expand=comments\u0026filter=id%3D1\nAuthorization: Bearer tk_2eef46f40ebab3304919ab2e7e39993f75f29d2e\n-\u003e 200, response items[0].comments contains the full comment objects\n```\n\nSame behaviour with `expand=reactions`, and on the v1 endpoints `GET /api/v1/tasks?expand=comments` / `GET /api/v1/tasks/1?expand=comments`. Any user-created token with only `tasks` read permissions reproduces this.\n\n## Recommended Fix\n\nEnforce expansions in the single existing choke point, `models.CanDoAPIRoute`: after the method/path match succeeds, read `c.QueryParams()[\"expand\"]` and require the token to hold the owning group's read permission for each value, e.g.\n\n- `comments`, `comment_count` -\u003e `tasks_comments.read_all`\n- `reactions` -\u003e `reactions.read_all`\n- `time_entries_count` -\u003e `time_entries.read_all`\n\n(`subtasks`, `buckets`, `is_unread` are task-level data and need nothing extra.) Doing this in the middleware covers both v1 and v2 without handler or model changes. Add a table-driven test alongside `pkg/webtests/api_token_method_matching_test.go` asserting a `tasks`-only token gets 401 with `expand=comments` and 200 once `tasks_comments.read_all` is added.","status":"published","published":"2026-10-09T20:51:52Z","modified":"2026-10-19T21:41:16.622292055Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"GHSA-phph-c358-5mwm","title":"Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9rg3-v78m-26q8. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without proper permission verification.","status":"withdrawn","published":"2026-09-15T18:32:30Z","modified":"2026-10-09T21:00:07.131108855Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"GO-2026-6726","title":"Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api","description":"Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api from v1.0.0 before v2.6.0.","status":"published","published":"2026-10-19T21:08:26Z","modified":"2026-10-19T21:31:52.830337014Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}