https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-12T08:44:22.111608+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-91985 fkie_cve-2026-91985 2026-10-12T08:44:22.141302+00:00

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.

 https://db.gcve.eu/vuln/ghsa-37rx-7pj5-p885 Withdrawn: GHSA-37rx-7pj5-p885 — Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share rea… 2026-10-12T08:44:22.141368+00:00

Withdrawn by the publisher.

Affected: Go: code.vikunja.io/api

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qfwc-vx6f-3g6g. This link is maintained to preserve external references.

### Original Description Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.