{"id":"CVE-2026-57458","published":"2026-10-09T21:17:05.190","lastModified":"2026-10-13T19:18:52.690","description":"Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://github.com/go-vikunja/vikunja/commit/4ae2e093014881052ed8f8ecd8bcb9adf83dd276","tags":[]},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0","tags":[]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v","tags":[]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-vikunja/vikunja/commit/4ae2e093014881052ed8f8ecd8bcb9adf83dd276","tags":[]},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0","tags":[]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v","tags":[]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v","tags":[]}],"hasPoc":true,"ai":{"summary":"A scoped API token with only 'oauth.authorize' permission can bypass authorization controls to obtain full user access tokens, allowing privilege escalation through OAuth flows. This means attackers with limited API access can gain complete user privileges.","exploitability":"Moderately difficult to exploit as it requires having a valid scoped API token with oauth.authorize permission, but the attack chain is straightforward once that precondition is met.","blast_radius":"The vulnerability affects all users who have any scoped API tokens with the oauth.authorize permission, potentially allowing attackers to access sensitive user data and perform unauthorized actions across the entire Vikunja platform.","remediation":"Upgrade to Vikunja version 2.4.0 or later to fix the authorization bypass vulnerability.","detection":"Monitor for POST /api/v1/oauth/authorize and POST /api/v1/oauth/token API calls that originate from scoped API tokens with oauth.authorize permissions, particularly when followed by access to restricted user resources.","tags":["auth-bypass","api","oauth","authorization"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:58:08.816Z"}}