CVE-2026-111922
Received Received - Intake

Permissive CORS in Vikunja Allows Account Takeover

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111922
EUVD
EUVD-2026-103290

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-vikunja vikunja 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja versions 2.2.0 to 2.7.0 have a permissive CORS configuration that trusts all localhost and 127.0.0.1 ports with credentials. This allows attackers controlling a page on any localhost port to send a credentialed request to the token refresh endpoint and steal the returned bearer JWT, enabling account takeover of logged-in users.

Detection Guidance

To detect this vulnerability, check if Vikunja is running on localhost or 127.0.0.1 with permissive CORS settings. Inspect network traffic for unauthorized credentialed requests to the token refresh endpoint. Verify if the service.publicurl is properly configured to restrict CORS origins.

Impact Analysis

If you use Vikunja in versions 2.2.0 to 2.7.0, an attacker could hijack your session by tricking you into visiting a malicious page on localhost. This could lead to unauthorized access to your Vikunja account and any sensitive data stored within it.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations and legal consequences if exploited.

Mitigation Strategies

Upgrade Vikunja to version 2.7.0 or later to address the permissive CORS issue. Ensure service.publicurl is correctly set to restrict access. Review and tighten CORS policies to only allow trusted origins. Monitor for suspicious credentialed requests to the token refresh endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart