CVE-2026-57458
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Deferred | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
Affected products
- affected = 2.3.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gocode.vikunja.io/apiGHSA-v3p6-34mc-hj7v (opens in a new tab)
References (3)
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/go-vikunja/vikunja/commit/4ae2e093014881052ed8f8ecd8bcb9adf83dd276 (opens in a new tab)x_refsource_MISC
- https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-v3p6-34mc-hj7v (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-57458)Record last updated .