GHSA-vcgv-7rvm-m3vp

Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API

Published

2026-09-15

Modified

2026-10-09

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfxw-3x8p-2vjr. This link is maintained to preserve external references. ### Original Description Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-vcgv-7rvm-m3vp