Key points
- CVE-2026-57458 allows scoped API tokens to bypass permission boundaries via the OAuth flow.
- The vulnerability affects Vikunja version 2.3.0 and is fixed in version 2.4.0.
- National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.1.
Vikunja version 2.4.0 patches a high-severity authentication bypass that allows attackers to escalate privileges using limited API tokens. The vulnerability, tracked as CVE-2026-57458, enables a token with only `oauth.authorize` permissions to generate full session credentials. This update resolves the issue by correcting the authentication context mismatch in the OAuth authorization flow.
How it unfolded
- A scoped API token authenticates a request and sets the current user context within the application.
- The `/api/v1/oauth/authorize` endpoint accepts this API-token-authenticated user as a valid OAuth resource owner.
- The system issues an authorization code, which is then exchanged at `/api/v1/oauth/token` for a normal bearer JWT and refresh token.
- The resulting credentials are not bound to the original API-token permissions, allowing access to restricted routes.
Who is affected
The flaw impacts users running Vikunja version 2.3.0, an open-source self-hosted task management platform. According to the GitHub advisory, the vulnerability affects scoped API tokens and the OAuth authorization flow components. Attackers who obtain or are delegated a limited token can convert it into normal session credentials for the same user. This bypasses the intended API-token permission boundary established by the administrator.
Runtime validation demonstrated that a token restricted to `oauth.authorize` could not access `GET /api/v1/user`. However, after minting new credentials via the OAuth flow, the attacker successfully accessed `GET /api/v1/user` and `GET /api/v1/projects`. The National Vulnerability Database assigns a CVSS score of 8.1, classifying the risk as high severity.
The exploitation chain relies on an authentication-context mismatch between scoped API-token authentication and OAuth authorization-code issuance. The vulnerable code paths are located in `pkg/routes/routes.go`, where the OAuth endpoints are registered in an authenticated API route group. This configuration incorrectly allows scoped API tokens to trigger the OAuth flow, which should typically require interactive user authentication.
What happens next
Vikunja version 2.4.0 is available to fix CVE-2026-57458. Administrators should apply this update immediately to restore proper permission boundaries for API tokens. The patch ensures that scoped tokens cannot be used to mint unrestricted session credentials through the OAuth endpoints. No cross-user access or privilege escalation to admin was validated in testing.
The vulnerability does not allow access to other accounts or administrative functions. The impact is limited to the same user context associated with the original scoped token. However, gaining full session access allows an attacker to view projects and user details that were previously hidden. This expands the potential data exposure significantly beyond the initial token scope.
What to do and how to stay safe: Vikunja
- Inventory all API tokens in your Vikunja instance and revoke any that have broader permissions than necessary.
- Update your Vikunja installation to version 2.4.0 as soon as possible to patch the authentication bypass.
- Monitor server logs for unusual OAuth authorization requests, particularly those originating from automated scripts or unknown IPs.
- Review access controls to ensure that scoped tokens are only issued to services that strictly require OAuth functionality.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-57458?
It is a high-severity vulnerability in Vikunja 2.3.0 that allows scoped API tokens to bypass permission limits via the OAuth flow.
Which versions of Vikunja are vulnerable?
Version 2.3.0 is affected. Version 2.4.0 contains the fix for this authentication bypass issue.
Can an attacker access other users' data?
No, testing showed no cross-user access. The attacker can only access routes for the same user associated with the token.
