CVE-2026-91981
Received Received - Intake

Vikunja User Enumeration via Link-Share Token Validation Flaw

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91981
EUVD
EUVD-2026-78652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja versions before 2.6.0 have a flaw where link-share tokens in the v2 API user search endpoints are not properly validated. Attackers with a read-only share link can exploit this to enumerate project users through the projects endpoint and confirm arbitrary usernames via the global search endpoint.

Impact Analysis

This vulnerability allows attackers to gather information about users in a project or system. They can confirm which usernames exist, potentially aiding further attacks like phishing or brute force attempts.

Mitigation Strategies

Upgrade Vikunja to version 2.6.0 or later to address the improper validation of link-share tokens in the v2 API user search endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91981. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart