CVE-2026-91985

Vikunja versions before 2.6.0 improperly expose the link-share hash field in single-share read endpoints, allowing any read-only member of a shared project or team to retrieve the share's secret credential. The attacker can then exchange that hash for a link-share JWT valid at the share's permission level, escalating privileges beyond their read-only role. Depending on the share's configured permissions, this enables unauthorized writes or administrative actions against the affected share. Instances running versions prior to 2.6.0 that use link sharing and grant read-only access to untrusted members are affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no in-the-wild exploitation has been observed.

What to do: Upgrade to Vikunja 2.6.0 or later, which restricts the link-share hash from read endpoints. Because previously disclosed hashes remain valid credentials, rotate or revoke all existing link shares and re-issue them. Review audit logs for unexpected link-share JWT activity and audit which read-only users had access to shares that carried elevated permissions.