GHSA-VFXW-3X8P-2VJR
Vulnerability from github – Published: 2026-10-09 20:52 – Updated: 2026-10-09 20:52Summary
A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share link can list every member of the shared project (and its parent projects), and can test whether any username exists anywhere on the instance.
Details
Two endpoints are affected:
GET /api/v2/projects/{id}/users/search only checks project.CanRead, which a link share satisfies on its own project. With no parameter it returns the full user list, walking up the parent-project chain.
GET /api/v2/users?q=<name> is a global search. It needs a query term, but any term works as an existence oracle: a hit confirms the username exists somewhere on the instance and returns the display name.
Emails are correctly stripped from these responses, so the exposure is limited to identities (usernames and display names), but that's still an instance-wide directory that a share-link holder should never see.
The fix is to resolve the caller with GetFromAuth in both handlers, so link-share tokens are rejected the same way v1 already rejects them.
PoC
- Get a link-share token. With any account that owns a project, create a read-only link share and note the hash, then exchange it:
POST /api/v1/shares/<hash>/auth
{"password":""}
The response contains a token, a link-share JWT.
- Confirm v1 blocks it (the fixed behavior). With that token:
GET /api/v1/projects/<id>/projectusers
Authorization: Bearer <link_share_token>
→ rejected: the token isn't a user token.
- Now the vulnerable v2 endpoints, same token:
GET /api/v2/projects/<id>/users/search
Authorization: Bearer <link_share_token>
→ 200, full list of everyone with access to the project and its parents (id, username, name).
GET /api/v2/users?q=admin
Authorization: Bearer <link_share_token>
→ 200, a non-empty result confirms the username exists on the instance. Iterate q over a wordlist to enumerate accounts.
Impact
Information disclosure. A link share is a low-trust credential meant to expose one project's contents; here it also exposes the membership of that project's parents and lets the holder probe for any username across the whole instance. Since share links are often forwarded or semi-public, this hands an untrusted recipient a map of internal users and a username-validation oracle useful for phishing and credential stuffing. No account is required beyond possessing a share link. Emails are not exposed.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.0"
},
"package": {
"ecosystem": "Go",
"name": "code.vikunja.io/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-91981"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-09T20:52:39Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nA link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don\u0027t. As a result, anyone with a share link can list every member of the shared project (and its parent projects), and can test whether any username exists anywhere on the instance.\n\n### Details\nTwo endpoints are affected:\n\n`GET /api/v2/projects/{id}/users/search` only checks project.CanRead, which a link share satisfies on its own project. With no parameter it returns the full user list, walking up the parent-project chain.\n`GET /api/v2/users?q=\u003cname\u003e` is a global search. It needs a query term, but any term works as an existence oracle: a hit confirms the username exists somewhere on the instance and returns the display name.\n\nEmails are correctly stripped from these responses, so the exposure is limited to identities (usernames and display names), but that\u0027s still an instance-wide directory that a share-link holder should never see.\n\nThe fix is to resolve the caller with GetFromAuth in both handlers, so link-share tokens are rejected the same way v1 already rejects them.\n\n### PoC\n1. Get a link-share token. With any account that owns a project, create a read-only link share and note the hash, then exchange it:\n```\nPOST /api/v1/shares/\u003chash\u003e/auth\n{\"password\":\"\"}\n```\nThe response contains a token, a link-share JWT.\n\n2. Confirm v1 blocks it (the fixed behavior). With that token:\n```\nGET /api/v1/projects/\u003cid\u003e/projectusers\nAuthorization: Bearer \u003clink_share_token\u003e\n```\n\u2192 rejected: the token isn\u0027t a user token.\n\n3. Now the vulnerable v2 endpoints, same token:\n```\nGET /api/v2/projects/\u003cid\u003e/users/search\nAuthorization: Bearer \u003clink_share_token\u003e\n```\n\u2192 200, full list of everyone with access to the project and its parents (id, username, name).\n```\nGET /api/v2/users?q=admin\nAuthorization: Bearer \u003clink_share_token\u003e\n```\n\u2192 200, a non-empty result confirms the username exists on the instance. Iterate q over a wordlist to enumerate accounts.\n\n### Impact\nInformation disclosure. A link share is a low-trust credential meant to expose one project\u0027s contents; here it also exposes the membership of that project\u0027s parents and lets the holder probe for any username across the whole instance. Since share links are often forwarded or semi-public, this hands an untrusted recipient a map of internal users and a username-validation oracle useful for phishing and credential stuffing. No account is required beyond possessing a share link. Emails are not exposed.",
"id": "GHSA-vfxw-3x8p-2vjr",
"modified": "2026-10-09T20:52:39Z",
"published": "2026-10-09T20:52:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vfxw-3x8p-2vjr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91981"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/pull/3688"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-vikunja/vikunja"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.6.0-user-enumeration-via-v2-api"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Vikunja: Link-share token can enumerate users through the v2 API"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.