fkie_cve-2026-57458

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.

GHSA-v3p6-34mc-hj7v — Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Affected: Go: code.vikunja.io/api

## Summary

A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials.

A token limited to:

```json {"oauth":["authorize"]} ```

can call `/api/v1/oauth/authorize`, receive an OAuth authorization code, exchange it at `/api/v1/oauth/token`, and obtain a normal bearer JWT plus refresh token. The resulting credentials are not restricted by the original API-token permissions.

## Affected Component

* Scoped API tokens * OAuth authorization flow * `POST /api/v1/oauth/authorize` * `POST /api/v1/oauth/token`

## Impact

A narrowly scoped API token with only `oauth.authorize` can be converted into normal session credentials for the same user.

This bypasses the intended API-token permission boundary. An attacker who obtains or is delegated such a limited token can mint a normal JWT and refresh token, then access routes outside the original token scope.

Runtime validation showed that the original scoped token could not access `GET /api/v1/user`, but the minted OAuth access token could access:

* `GET /api/v1/user` * `GET /api/v1/projects`

No cross-user access, privilege escalation to admin, or access to another account was validated.

## Technical Details

The issue is caused by an authentication-context mismatch between scoped API-token authentication and OAuth authorization-code issuance.

The vulnerable chain is:

1. A scoped API token authenticates the request and sets the current user context. 2. `/api/v1/…

Most recent entries from all

fkie_cve-2026-57458

GHSA-v3p6-34mc-hj7v — Vikunja: Scoped API token can mint unrestricted OAuth session credentials