Vikunja API Token Privilege Escalation via ID Confusion

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Fixed in version 2.4.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Vikunja versions 0.22.0 through 2.3.0 contain a critical authentication bypass vulnerability in token management that allows attackers to escalate privileges by exploiting ID confusion between user accounts and link-share tokens. The vulnerability stems from insufficient validation of principal types in JWT token handling—the system treats user IDs and link-share IDs as interchangeable numeric values through a generic authentication interface. An authenticated attacker can enumerate target user IDs via the search API, then craft a malicious link-share JWT with a numeric ID matching their target, effectively impersonating that user when accessing token management endpoints. This affects any organization running vulnerable Vikunja versions and exposes all users to account takeover risks, particularly administrators whose IDs are easier to predict or enumerate.

Casky's 283 mapped skills detect this attack pattern by analyzing authentication and privilege escalation behaviors across MITRE ATT&CK's TA0004 (Privilege Escalation) and TA0006 (Credential Access) tactics. Practitioners using Casky would identify suspicious indicators including: anomalous API token creation events originating from link-share contexts, JWT tokens with mismatched principal type metadata, enumeration of user IDs through search functionality followed by token generation, and lateral movement patterns where a compromised link-share ID gains access to authenticated endpoints. Extended reasoning across the skill set would flag the semantic inconsistency of principal-type validation failures and correlate user enumeration activity with subsequent unauthorized token operations, surfacing the ID confusion pattern that distinguishes this from standard authentication bypasses.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-68581.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-68581

Casky has 283 skills that investigate the attack patterns behind CVE-2026-68581. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn