Vikunja 2.4.0 patches high-severity OAuth token privilege bypass

Vikunja has released version 2.4.0 to address a high-severity vulnerability that allows attackers to bypass API token permission restrictions using the platform’s OAuth authorization flow. The flaw, tracked as CVE-2026-57458, enables a narrowly scoped API token to generate unrestricted session credentials for the same user.

According to the GitHub Security Advisory GHSA-v3p6-34mc-hj7v, an API token limited only to the `oauth.authorize` permission can exploit the vulnerability to obtain a normal bearer JSON Web Token (JWT) and a refresh token. These new credentials are not bound by the original API token’s permission constraints. Consequently, an attacker possessing such a limited token can access API routes that were previously out of scope, such as retrieving user details or project lists. The National Vulnerability Database assigns the issue a CVSS score of 8.1, categorizing it as high severity and citing CWE-269 (Improper Privilege Management) as the underlying weakness.

Technical Context

The vulnerability stems from an authentication-context mismatch between scoped API-token authentication and the issuance of OAuth authorization codes. The exploit chain begins when a scoped API token authenticates a request, establishing the current user context. The `/api/v1/oauth/authorize` endpoint accepts this API-token-authenticated user as a valid OAuth resource owner and issues an authorization code.

The attacker then exchanges this code at the `/api/v1/oauth/token` endpoint to receive a standard bearer JWT and refresh token. Because these resulting credentials are not restricted by the original API token’s permissions, they grant broader access within the same user account. Runtime validation confirmed that while the original scoped token could not access endpoints like `GET /api/v1/user`, the minted OAuth access token could successfully retrieve data from `GET /api/v1/user` and `GET /api/v1/projects`.

The advisory notes that the relevant code paths involve `pkg/routes/routes.go`, which registers the OAuth authorize endpoint in an authenticated API route group that accepts scoped API tokens. No cross-user access, privilege escalation to administrative rights, or access to other accounts was validated during testing. The issue is specific to the same user context associated with the compromised API token.

Affected Systems

The vulnerability affects Vikunja, an open-source self-hosted task management platform. Specifically, version 2.3.0 is vulnerable. Users running this version are exposed to the risk of local privilege escalation for any account that possesses a scoped API token with the `oauth.authorize` permission. The fix is included in version 2.4.0. There is no indication in the source material that versions prior to 2.3.0 are affected, nor is there mention of other software packages being impacted by this specific CVE.

What should you do?

Administrators running Vikunja should verify their current version and upgrade to 2.4.0 immediately if they are on 2.3.0. Until the update is applied, organizations should audit their API tokens to identify any that have been granted the `oauth.authorize` permission. If possible, revoke or rotate these tokens to minimize the attack surface. Monitor logs for unusual OAuth authorization requests originating from API tokens, as this may indicate exploitation attempts.