https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 23:13:23 +0000 https://db.gcve.eu/vuln/cve-2026-57458 <p><strong>Affected:</strong> go-vikunja vikunja</p> <p>Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token&#39;s permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.</p> <p><strong>Affected:</strong> go-vikunja vikunja</p> <p>Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token&#39;s permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.</p> https://db.gcve.eu/vuln/cve-2026-57458