CVE-2026-91983

Executive Summary

CVE-2026-91983 is an authorization bypass vulnerability in the Vikunja open-source task management application affecting versions prior to 2.6.0. The flaw resides in task read endpoints, where authorization logic fails to inspect query string parameters, allowing a holder of a narrowly-scoped API token to retrieve restricted data—specifically comments, reactions, and time entries—by supplying an expand parameter that the authorization layer does not evaluate. With a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), impact is limited to confidentiality against an authenticated low-privileged principal, but the weakness is trivially automatable and undermines the intended least-privilege guarantees of Vikunja's API token scope model.

Technical Analysis

Vikunja is a self-hosted, open-source to-do and project management platform exposed via a REST API. The platform supports scoped API tokens that are intended to grant access to a defined subset of resources and operations. CVE-2026-91983 describes a scope enforcement failure (CWE-863: Incorrect Authorization) in the task read endpoints.

The core defect is architectural rather than cryptographic: the authorization routine for task read operations does not inspect query string parameters when evaluating whether a caller's token scope permits access to associated data. Vikunja's task API supports an expand parameter, which instructs the server to embed related objects—such as comments, reactions, and time entries—into the task response. Because the authorization check is applied only to the top-level task object and not to the expanded relations referenced by the query string, a token scoped to read tasks (but not comments, reactions, or time entries) can still cause those restricted objects to be serialized into the response.

This is a classic parameter-aware authorization gap: the endpoint's access decision is decoupled from the full set of resources the request can cause to be returned. The request is well-formed and uses legitimate API surface—no injection, no memory corruption—so permissive HTTP-layer defenses (WAFs, rate limiting, authentication) will not distinguish it from normal traffic. Successful exploitation requires only:

1. Network reachability to the Vikunja API (AV:N).
2. A valid, low-privilege API token (PR:L).
3. Knowledge of a task identifier accessible under the token's scope.
4. A crafted expand query parameter value.

No user interaction is required (UI:N), the vulnerable component is the application itself (S:U), and the flaw yields unauthorized read access to data (C:L). There is no integrity or availability impact (I:N/A:N) because the operation is read-only.

The public description does not enumerate the exact internal function, handler, or middleware names involved, and this report does not invent them. The vulnerability class, affected endpoints (task read), the specific parameter (expand), and the exposed data categories (comments, reactions, time entries) are drawn directly from the NVD description.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is currently available for CVE-2026-91983. The attack chain below is inferred from the vulnerability class (authorization bypass via unvalidated query parameters) and the specific details present in the NVD description.

1) Reconnaissance / Target Identification. An attacker identifies an internet- or intranet-exposed Vikunja instance. Self-hosted deployments are commonly surfaced via HTTP title and HTML fingerprinting; the Shodan dorks in the Metadata section can locate candidate hosts. The attacker must also possess a valid API token—either issued to them as a legitimate but constrained user, obtained via phishing, credential reuse, or leaked CI/CD secrets, or via a separate access-control weakness. Organizationally, this makes the CVE most dangerous in multi-tenant or contractor-access scenarios where scoped tokens are intentionally handed out.

2) Triggering the Flaw Class. Authorization bypass via query string parameter is triggered by sending a request to a task read endpoint that includes an expand parameter requesting restricted relations. Because the authorization routine fails to inspect query string parameters, the scope check passes on the base task object while the server still resolves and returns the expanded relations. The endpoint class is "task read"; the parameter name expand and the target data types (comments, reactions, time entries) are explicit in the description. No specific URL path or query value syntax is asserted here because the description does not provide one.

3) Execution Method. The attack is a single authenticated HTTP request (or a short sequence enumerating task IDs) carrying the low-privilege token. It requires no special encoding, no malformed input, and no client-side exploitation. From a detection standpoint, it is indistinguishable from legitimate API usage at the HTTP framing layer; only application-level logging that records query strings and the expanded object set can surface it.

4) Post-Exploitation Impact. The attacker gains read access to comments, reactions, and time entries that their token scopes were designed to withhold. These artifacts frequently carry sensitive operational detail: internal deliberation in comments, participant identities via reactions, and effort/billing data in time entries. An attacker can iterate over accessible task IDs to harvest these relations at scale. The impact is confidentiality-only and scoped to the token's reachable task set, but it directly defeats the least-privilege contract that motivates scoped API tokens in the first place.

Impact Assessment

The CVSS v3.1 base score of 4.3 reflects a Moderate-severity issue: Network attack vector, Low attack complexity, Low privileges required, No user interaction, Unchanged scope, Low confidentiality impact, and no integrity or availability impact. The practical blast radius is bounded by the reachable task set of the compromised token, but within that set it is complete—every expandable relation becomes readable regardless of scope.

Business impact includes:

• Confidentiality of project metadata: Comments and time entries often contain internal reasoning, customer names, deadlines, and effort/billing figures that a contractor or limited-scope integration should not see.
• Third-party and integration risk: API tokens are frequently issued to CI pipelines, dashboards, and partner integrations; a leaked or over-shared token converts directly into cross-project data exposure.
• Compliance exposure: Time-entry and comment data can map to client-billable records and internal communications, which may fall under contractual or regulatory confidentiality obligations.
• Trust erosion in the scoped-token model: Because the platform advertises scoped tokens as a security boundary, the bypass weakens the platform's core authorization promise for every self-hosted deployment.

The EPSS score of 0.00270 (~19.3rd percentile) indicates low predicted exploitation likelihood in the near term, and the vulnerability is not in CISA KEV. Absence from KEV, however, reflects current observed activity, not intrinsic risk—authorization bypasses in widely self-hosted tools are frequently weaponized later, especially after public disclosure or PoC release.

Detection Guidance

Detection for this authorization bypass must rely on application and API-layer telemetry rather than network signatures, because the request is well-formed and authenticated. Log task read requests that carry an expand query parameter and correlate them with the token's declared scope.

Sigma Rule

title: Vikunja API Token Scope Bypass via expand Parameter (CVE-2026-91983)
id: 7f3c2a10-9b64-4d2e-8c11-vikunja91983
status: experimental
description: Detects task read requests that use the expand query parameter, which can bypass API token scopes to expose comments, reactions, and time entries.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91983
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_path:
    cs-uri-query|contains:
      - 'expand='
  selection_verb:
    cs-method: 'GET'
  filter_static:
    cs-uri-extension:
      - 'js'
      - 'css'
      - 'png'
      - 'svg'
  condition: selection_verb and selection_path and not filter_static
falsepositives:
  - Legitimate clients that intentionally request expanded relations with a token that is authorized for those relations
level: low
tags:
  - attack.t1190
  - cve.2026.91983

YARA Rule

rule CVE_2026_91983_Vikunja_Expand_Scope_Bypass
{
    meta:
        description = "Detects HTTP request artifacts referencing Vikunja task read expand parameter indicating CVE-2026-91983 exploitation"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91983"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $api   = "/api/v1/tasks/" ascii nocase
        $exp   = "expand=" ascii nocase
        $t1    = "comments" ascii nocase
        $t2    = "reactions" ascii nocase
        $t3    = "time_entries" ascii nocase

    condition:
        $api and $exp and any of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91983 Vikunja API token scope bypass via expand parameter"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/tasks/"; http.uri; content:"expand="; http.uri; pcre:"/expand=(?:[^&]*,)*(comments|reactions|time_entries)/i"; classtype:attempted-recon; reference:cve,2026-91983; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91983; sid:202691983; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ any where
      url.path : "/api/v1/tasks/*" and
      url.query : "*expand=*" and
      (url.query : "*comments*" or url.query : "*reactions*" or url.query : "*time_entries*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=vikunja
| eval q=lower(cs_uri_query)
| where match(cs_uri_path, "(?i)/api/v1/tasks/") AND match(q, "expand=") AND match(q, "(comments|reactions|time_entries)")
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_uri_path) as paths by src_ip, user
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="vikunja,web,cve-2026-91983,">
  <rule id="202691" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <match>/api/v1/tasks/</match>
    <field name="query">expand=</field>
    <regex type="pcre2">(?i)expand=.*(comments|reactions|time_entries)</regex>
    <description>Vikunja task read via expand parameter may bypass API token scope (CVE-2026-91983)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_91983,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) claims a patch, which has not been independently confirmed. Treat the fix status as provisional until validated against the upstream repository and release artifacts.

1) Immediate mitigations (apply before upgrade validation):

• Audit and rotate all API tokens; revoke tokens issued to tenants, integrations, or contractors whose scopes are narrower than their underlying data should require.
• Restrict network exposure of the Vikunja API to trusted networks or place it behind an authenticated reverse proxy where feasible.
• Tighten rate limits and alert on bulk task read activity carrying expand parameters (see detection section).
• If the source code is available to your team, verify at the code level whether task read handlers inspect query string parameters during scope enforcement, and hot-fix the authorization check to evaluate expand-referenced relations against token scope.

2) Patch / upgrade steps:

• Upgrade Vikunja to 2.6.0 or later per the OSV advisory.
• Because patch confidence is 2/4, independently confirm the fix in the vendor's release notes, changelog, and VCS commit history before closing the finding. Verify that the authorization routine now validates the expanded relations against the caller's token scope, and test with a deliberately under-scoped token.
• Re-validate scoped-token behavior after upgrade using a comment/reaction/time-entry resource that is outside the token's intended scope.

3) Long-term hardening:

• Adopt parameter-aware authorization testing in CI: any query parameter that can expand, embed, or pivot to related resources must be covered by scope enforcement unit tests.
• Implement a deny-by-default serializer policy that strips relation fields not explicitly authorized by the calling token's scope.
• Centralize authorization so the same scope check runs for base objects and all relations.
• Log and retain API query strings with token identity to enable retrospective hunting for this class of bypass.

References

1. NVD — CVE-2026-91983: https://nvd.nist.gov/vuln/detail/CVE-2026-91983
2. OSV Advisory (patch claim source): https://osv.dev/ (search CVE-2026-91983)
3. Vikunja project home and release notes: https://vikunja.io
4. CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
5. CISA Known Exploited Vulnerabilities Catalog (status: not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and in-the-wild evidence: None available. CVE-2026-91983 is not in CISA KEV, no public PoC, exploit code, or Nuclei template has been observed, and EPSS is 0.00270 (~19.3rd percentile). The attack chain in this report is inferred from the vulnerability class and NVD description, not from observed exploitation.