CVE-2026-68581: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Vikunja routes API-token management through a generic authenticated principal and derives user-owned token authorization from web.Auth.GetID(). A link-share principal returns its independent share-row ID through that same interface. When the numeric values collide, the application mistakes a link share for an unrelated user at the API-token owner boundary.

We can steer the reachable collision through ordinary authenticated user search and link-share creation when the target ID has not already been passed. From the colliding share, the validated behavior lists target-owned token metadata, issues a scoped API token owned by the target, uses that credential under the target’s project permissions, and deletes target-owned tokens. The strongest demonstrated impact is cross-account confidentiality and integrity, not browser-session or server compromise.

The immediate fix is to require a positive regular-user principal throughout API-token management and to cover GET, PUT, and DELETE with negative link-share tests and positive user controls. A broader review of user-owned models that accept generic numeric principals would be useful variant analysis, but no additional vulnerability is claimed here.