By successfully exploiting this confusion, an unauthorized actor can perform privileged administrative actions, including removing victims from teams, enumerating and deleting bot users, or exfiltrating sensitive team roster information. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and represents a significant risk to teams relying on Vikunja for sensitive task and project management. Defenders should prioritize patching to version 2.4.1 or later to implement the missing type guard logic.

Attack Chain

1. The attacker obtains or generates a valid link-share JWT for a shared Vikunja resource.
2. The attacker identifies the target user's ID or the ID of a target bot user within the application's autoincrement sequence.
3. The attacker crafts a request to the Vikunja API, injecting their link-share JWT.
4. The request hits one of the three vulnerable permission check endpoints lacking type validation.
5. The backend application erroneously maps the attacker's 'LinkSharing' principal ID to the target 'user' principal ID due to the lack of type guards.
6. The application performs authorization logic assuming the attacker is the authenticated user associated with the collided ID.
7. The attacker executes unauthorized operations, such as deleting a bot user or accessing the team roster.
8. The final objective is achieved: unauthorized modification of team configurations or exfiltration of roster data.

Impact

Successful exploitation allows for unauthorized modification of team structures and data exfiltration. Attackers can specifically remove legitimate team members, delete automation bot users, and access private team rosters. This results in the disruption of project management workflows and potential disclosure of sensitive project data for all organizations utilizing vulnerable versions of Vikunja.

Recommendation

• Patch all instances of Vikunja to version 2.4.1 or later immediately to address CVE-2026-76216.
• Audit application access logs for unusual patterns of API requests originating from JWT-authenticated sessions that involve administrative endpoints (e.g., team membership or user deletion).
• Review all team rosters for unauthorized modifications or missing bot users that may indicate past exploitation.
• Implement strict rate limiting on API endpoints to mitigate attempts to brute-force or guess sequential user/principal IDs.