CVE-2026-57458

Executive Summary

CVE-2026-57458 is a privilege-escalation vulnerability in Vikunja, an open-source self-hosted task management platform. In version 2.3.0, a low-privileged API token scoped only to the oauth.authorize permission can be leveraged to obtain a full-privilege bearer JWT and refresh token via the OAuth authorization-code flow, bypassing the intended scope restrictions. Successful exploitation grants the attacker access to all routes available to the underlying user account, resulting in high confidentiality and integrity impact (CVSS 8.1).

Technical Analysis

The vulnerability is classified as CWE-269 (Improper Privilege Management). Vikunja supports scoped API tokens, which are intended to limit a token's capabilities to a declared subset of permissions. In version 2.3.0, a token scoped exclusively to oauth.authorize can be used to invoke POST /api/v1/oauth/authorize, which issues an OAuth authorization code. That code can then be submitted to POST /api/v1/oauth/token to obtain a normal bearer JSON Web Token (JWT) and a refresh token.

The core flaw is a scope-enforcement gap in the OAuth authorization-code exchange flow: the credentials subsequently issued are not bound to the original API token's declared scope. Instead, the JWT and refresh token carry the full privileges of the authenticated user, not the restricted permissions of the token that initiated the flow. This effectively converts a narrowly scoped, low-privilege token into a fully privileged session for the same user.

Key characteristics derived from the NVD description:

• Attack vector: Network (AV:N), requiring only a low-privileged credential (PR:L) — specifically any API token holding the oauth.authorize scope.
• Complexity: Low (AC:L); no user interaction required (UI:N).
• Scope: Unchanged (S:U) — the impact is confined to the same user's resources but escalates from a scoped token to the user's full privilege set.
• Confidentiality/Integrity: High (C:H/I:H); Availability: None (A:N).

The vulnerability class is a privilege-management/authorization bypass: the OAuth authorization-code grant does not correctly propagate or enforce the initiating token's scope onto the resulting tokens. No function names, class names, or additional endpoints beyond those quoted in the NVD description are asserted here. Where the description is silent (e.g., exact token encoding, internal validation logic), the report describes only the vulnerability class and mechanism.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred from the vulnerability class (CWE-269) and the explicitly described endpoints.

1. Reconnaissance / target identification: The attacker identifies a reachable Vikunja 2.3.0 instance (self-hosted task management platform). The attacker possesses, or has obtained, a low-privileged API token for a legitimate user that is scoped to the oauth.authorize permission only. How such a token is provisioned (e.g., a narrowly scoped integration or third-party app token) is the precondition; this is not described in the CVE data.

2. Triggering the flaw class: Using the scoped token, the attacker calls POST /api/v1/oauth/authorize. Because the token holds the oauth.authorize permission, the request is accepted and an OAuth authorization code is returned. The scope limitation intended to constrain this token is not enforced on the OAuth flow's output.

3. Payload / execution (vulnerability-class level): The attacker submits the obtained authorization code to POST /api/v1/oauth/token. The server exchanges the code and returns a normal bearer JWT and a refresh token. These credentials are not restricted by the original API token's permissions — they carry the full privilege set of the associated user.

4. Post-exploitation impact: With the full-privilege JWT (and refresh token for persistence), the attacker can access routes outside the original token's declared scope for the same user. This yields broad read and write access to that user's tasks, projects, and related data. The refresh token extends the attacker's session beyond the lifetime of the JWT, enabling continued access and persistence until the credential is revoked.

The attack requires no user interaction and no elevated pre-existing privileges beyond a token with the oauth.authorize scope, aligning with the CVSS vector PR:L / UI:N. The escalation is bounded to the same user's permissions (S:U), not full administrative takeover of the platform, unless the compromised user already holds administrative rights.

Impact Assessment

Business impact centers on unauthorized access to self-hosted task management data, which frequently contains project plans, internal communications, credentials-in-notes, and integration secrets. Because the attacker gains the full privileges of the compromised user, the blast radius is the entire accessible dataset for that account — high confidentiality and integrity impact (C:H/I:H).

• Confidentiality (High): Full read access to the user's tasks, projects, and any linked data.
• Integrity (High): Full write access, allowing manipulation or deletion of the user's content.
• Availability (None): The description does not indicate a denial-of-service component.
• Scope (Unchanged): Escalation is confined to the same user's privilege set.

Affected systems are self-hosted Vikunja deployments running version 2.3.0. Organizations that issue narrowly scoped API tokens — particularly those trusted by third-party integrations — face a privilege-escalation risk where a limited token can be silently upgraded to full user access. The attacker could pivot within integrated services if the compromised account holds elevated or administrative rights. CISA KEV status is NO, and no exploit-in-the-wild evidence is described in the provided data.

Detection Guidance

Sigma Rule

title: Vikunja OAuth Scope Escalation via Scoped API Token (CVE-2026-57458)
id: 8f3a1c2e-5b6d-4e7a-9c10-vikunja57458
status: experimental
description: Detects a scoped oauth.authorize API token being used to obtain an OAuth authorization code and exchange it for a full-privilege JWT/refresh token.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57458
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: vikunja
detection:
  selection_authorize:
    cs-method: 'POST'
    cs-uri-stem: '/api/v1/oauth/authorize'
  selection_token:
    cs-method: 'POST'
    cs-uri-stem: '/api/v1/oauth/token'
  condition: selection_authorize or selection_token
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate OAuth login flows by authorized users
  - Normal third-party app authorization
level: medium

YARA Rule

rule CVE_2026_57458_Vikunja_OAuth_Scope_Escalation
{
    meta:
        description = "Detects HTTP request sequences targeting Vikunja OAuth authorize/token endpoints associated with CVE-2026-57458"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57458"
        date = "2026-01-01"
        severity = "high"
    strings:
        $authz = "/api/v1/oauth/authorize"
        $token = "/api/v1/oauth/token"
        $scope = "oauth.authorize"
        $jwt = "eyJ" ascii
    condition:
        uint16(0) == 0x4854 and
        (($authz and $token) or ($authz and $scope) or ($token and $jwt))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-57458 Vikunja OAuth Scope Escalation - authorize then token exchange"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/oauth/authorize"; nocase; http.uri; content:"/api/v1/oauth/token"; nocase; threshold:type both, track by_src, count 2, seconds 60; classtype:attempted-privilege-escalation; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-57458; sid:202657458; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [http where http.request.method == "POST" and url.path == "/api/v1/oauth/authorize"]
  [http where http.request.method == "POST" and url.path == "/api/v1/oauth/token"]

Splunk SPL Query

index=web OR index=proxy
(uri_path="/api/v1/oauth/authorize" OR uri_path="/api/v1/oauth/token")
http_method=POST
| stats count values(uri_path) as paths dc(uri_path) as distinct_paths by src_ip, user
| where distinct_paths >= 2
| sort - count

Wazuh OSSEC Rule

<group name="vikunja,web,privilege_escalation,">
  <rule id="100458" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/api/v1/oauth/authorize</field>
    <description>CVE-2026-57458: Possible Vikunja OAuth scope escalation - authorize endpoint accessed</description>
    <group>cve-2026-57458,</group>
  </rule>
  <rule id="100459" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/api/v1/oauth/token</field>
    <description>CVE-2026-57458: Vikunja OAuth token exchange observed - possible full-privilege token issuance</description>
    <group>cve-2026-57458,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source, GHSA, claims a fix; not independently confirmed).

1. Immediate mitigations:

   • Restrict or disable the issuance of API tokens scoped to oauth.authorize where not required.
   • Monitor and rate-limit access to POST /api/v1/oauth/authorize and POST /api/v1/oauth/token.
   • Revoke and rotate any API tokens that hold the oauth.authorize scope and audit recent use of these endpoints for unexpected token exchanges.
   • Where feasible, isolate the Vikunja instance from untrusted networks and require strong authentication (MFA) for accounts that hold scoped tokens.
   • Invalidate existing refresh tokens and JWTs if suspicious exchange activity is detected.

2. Patch/upgrade steps:

   • Upgrade Vikunja to version 2.4.0, which the advisory (GHSA) states resolves the vulnerability.
   • Verify the upgrade against the official project release channels, since the patch claim is single-sourced and not independently confirmed.

3. Long-term hardening:

   • Enforce strict scope propagation so that tokens derived from an authorization-code exchange inherit the initiating token's scope rather than the user's full privilege set.
   • Implement continuous authorization auditing for OAuth flows, alerting on any scope widening between token issuance and derived credentials.
   • Apply least privilege to all integration tokens and periodically review token scopes.

References

• NVD — CVE-2026-57458: https://nvd.nist.gov/vuln/detail/CVE-2026-57458
• GitHub Security Advisory (GHSA) — patch reference for Vikunja 2.4.0 (single-source; cited in Patch Sources)
• CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• FIRST EPSS — Not yet scored for this CVE (no score available at time of writing)
• CISA KEV — Not listed (no known exploited-in-the-wild designation)

No threat actor campaigns, public PoC, exploit code, or Nuclei template are associated with this CVE based on the provided data. Exploit-in-the-wild evidence is absent.