CVE-2026-76216: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
(updated )
Vikunja’s web.Auth interface (pkg/web/web.go, single method GetID() int64) is satisfied by BOTH *user.User and *models.LinkSharing. A link-share’s GetID() returns the raw positive share.ID (pkg/models/link_sharing.go:83-85), which lives in the same positive autoincrement ID space as users.id. The safe negated form getUserID() = share.ID * -1 (link_sharing.go:126-128) exists but is NOT used at three permission sinks. As a result, a link-share principal with id N — which should have zero authority over teams or bot users — is treated as the user whose users.id == N at three permission checks that lack the a.(*LinkSharing) guard their sibling methods have. This is the same principal-type-confusion class as CVE-2026-68581 (GHSA-vvcv-vpph-h844), but at three code paths that advisory/fix never touched.
References
- github.com/advisories/GHSA-32r8-5843-4qw2
- github.com/go-vikunja/vikunja/commit/a717d64d5658708ba390f18dd697f5e567e68aac
- github.com/go-vikunja/vikunja/releases/tag/v2.5.0
- github.com/go-vikunja/vikunja/security/advisories/GHSA-32r8-5843-4qw2
- nvd.nist.gov/vuln/detail/CVE-2026-76216
- www.vulncheck.com/advisories/vikunja-through-principal-type-confusion-via-linksharing
Code Behaviors & Features
Detect and mitigate CVE-2026-76216 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →